My Ryzen board trusted Microsoft out of the box, it has to if they want to pass Windows logo certification. You can check yours here: https://partner.microsoft.com/en-us/dashboard/hardware/searc...
That's the entirety of my complaint.
Thanks for the link! My board is not on it as I assumed.
Sure, they're loaded by default, and you can argue that we can't prove the board isn't gonna trust them behind your back -- but that applies to older non-open hardware too.
My bigger annoyance is Intel Boot Guard. I want Intel to let us control the firmware more directly -- even if it requires some physical authorization/kills some DRM component in ME or something. But that's not happening anytime soon...
The requirements mentioned by grandparent are for setup where without any extra configuration you can approach a computer with Windows 10 install media and it will install properly.
You can do this on any x86/x86_64 hardware made in the past 15 years. Whether your machine has a traditional BIOS, UEFI with SecureBoot off, or UEFI with SecureBoot on, Windows 10 will install with zero complaints.
You only get to be "certified by Microsoft" if you follow all of their rules, but you don't have to be certified to install Windows 10 (yet).
It also covers "will work as advertised", i.e. certain features will operate properly. And secured boot path is, indeed, one of such features.
This one in particular always pissed me off, and I'm glad it only applies to pre-built machines that come with Windows 10 preinstalled. If the individual motherboard makers ever decide they need to be "certified for Windows 10" and start auto-trusting a certificate for closed-source commercial software, I'm left with no choice but to either stick with my "old" (not really that old) hardware or switch to another platform like POWER9.