AFAIK it's on by default in Ubuntu? > Modules built and shipped by Canonical with the official kernels are signed by the Canonical UEFI key and as such, are tr

AFAIK it's on by default in Ubuntu? > Modules built and shipped by Canonical with the official kernels are signed by the Canonical UEFI key and as such, are trusted. Custom-built modules will require the user to take the necessary steps to sign the modules before they loading them is allowed by the kernel. https://wiki.ubuntu.com/UEFI/SecureBoot https://wiki.ubuntu.com/UEFI/SecureBoot