Which is why every trusted computing platform with free software on it should have an owner override. (The total count of such platforms is, as far as I know, unfortunately zero.)

Pretty much every x86 system with a TPM and UEFI Secure Boot can have the secure boot keys swapped out by the owner.

I recently went to write a kernel module on my Ubuntu system, only to discover the boot loader now defaulted to "secure boot" nonsense and I couldn't insmod a non-signed module.

I tried to simply disable "secure boot" in the BIOS settings and then the boot loader just did absolutely nothing. Hot fucking garbage.

Apparently, if you have "secure boot" available during the install it will use "secure boot" without any way to opt-out.

Did you try disabling it in shim-signed instead of the BIOS (method 2 on this page [1])? I'd expect that to be more consistent and/or reliable since BIOS quality can vary a lot from vendor to vendor.

You might also try signing the kernel module yourself (the manual method at the bottom of that page)?

[1] https://wiki.ubuntu.com/UEFI/SecureBoot/DKMS

I don't want to do any of that. I just want to insmod a module like I've been doing since 1995.