Microsoft signed an open source bootloader called Shim, which can run out of the box on any PC. You can use Shim to load your own GRUB2 and set your own keys. Shim is used by Fedora, Ubuntu, and Debian so far. A good writeup is available here https://wiki.debian.org/SecureBoot