If you can get to the firmware settings, there should be an option to 'disable secure boot', 'enable third-party OS's' or the like. Then you should be able to boot anything that has been properly signed, at least. I'm quite sure that people have done this, even on the Surface Go.