I have yet to see a firmware that doesn't allow me to enroll private keys. It's a basic UEFI features, and IIRC Microsoft requires that to be possible for intel hardware: if you don't, no Windows.

When you control the keys, SecureBoot is a good thing at least as good as encryption!

There are things that are fair to complain about, but on this, I don't see how Microsoft or anyone could have done any better to be playing nice with Linux while helping customers.