On further searching, it appears this was originally implemented for [U]EFI booting, and the Mac now does it as well. It appears the certificates may be controlled by Microsoft.
Linux distributions only have a “shim” [11] signed at the Microsoft portal. The shim is a small boot loader which boots the Linux distributions main GRUB boot loader. Microsoft only checks the signed shim and thereafter your Linux distribution boots normally. This helps to maintain the Linux system as usual.
As reported from various sources, (U)EFI works fine with Fedora/RedHat, Ubuntu, Arch Linux and Linux Mint. For Debian GNU/Linux there is no official support regarding Secure Boot [9]. Anyway, there is an interesting blog post on how to set this up [18] , as well as a description in the Debian Wiki [14].
from:
https://linuxhint.com/secure-boot-linux/
.