If I can’t upload my own signing keys to be trusted, it’s as good as useless to me. So, option (2) would be ok, but having to rely on _Microsoft_ to run Linux on my laptop is exactly the sort of scenario everyone was afraid of 20 years ago.
I personally haven't seen a computer yet that doesn't allow this. Even if it's not provided the option to disable secure-boot is still available.
Phones are the real problem. As far as I can find only the Pixel phones will allow secure boot with a custom OS. If you own another phone you're already locked in to your manufacturers keys or no keys.