This is idiotic. The requirement should be that the user can disable it entirely OR replace the private key. And it should require implementation of an optional password protection.
Mandatory. On non-ARM systems, the platform MUST implement
the ability for a physically present user to select
between two Secure Boot modes in firmware setup: "Custom"
and "Standard".