AFAIK the enforced SB without allowing "3rd-party" keys is specific to (32bit ARM!) RT devices, which are obsolete. The current line of "Windows on Arm" devices (various Laptops and their "Volterra" dev kit) allow turning off secure boot.