Afaict, you can't disable driver signature enforcement permanently without disabling secure boot.
https://learn-attachment.microsoft.com/api/attachments/f8eac...
You can also roll you own encryption if you are not stupid and naive. Probably a question of self-reflection.