You can self-sign keys. Secure Boot has had a mechanism for that already for years (mok on Linux).