You can always set the system up to boot in insecure mode via shim, even if UEFI Secure Boot is active. It requires an explicit configuration step with physical presence, but it's doable.