It does mean that a signed OS image is running, so demonstrates that the kernel was unaltered at start-up.

It also demonstrates further levels of driver signing robustness.

I'm not really familiar with Secure Boot too much. Researching suggests that users can add their own keys so they are trusted by UEFI. Won't this resolve for linux users that must have secure boot on?

It's usually a giant pia.

Some distros support it, some make it really difficult.

I like to distro hop. I'll often have to try two or three to get to a working system.

I've had no issues setting it up with Fedora and Ubuntu with kmods/Nvidia drivers. I just say I want it, and I have it. It's really easy now.

No, it's not a given that users can add their own keys - certainly in an anticheat scenario they probably couldn't, or at least if they did then key attestation would stop working.