> The further problem if you can turn off secure boot is that these pieces of hardware often can’t then be turned back on with a different secure boot chain – say, one based on open source software.

Is your statement meant to be inclusive of, say, all laptops? I was under the impression that one can setup a machine to boot using personal keys rather than Microsoft keys: https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/