All major distributions ship with shim enabled IIRC, so should work with Secure Boot.
Doesn't matter. Secure boot just requires that the bootloader is signed with an approved key. Most major distros already have this down as Microsoft will happily sign any bootloader that isn't a glaring hole for a small sum of money.
Obligatory Wikipedia reference: https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_In...