Edit: so like Secure Boot with only Windows key, Secure Boot with Microsoft-approved key (note that the key used for Windows and key for Linux signing is differ

Edit: so like Secure Boot with only Windows key, Secure Boot with Microsoft-approved key (note that the key used for Windows and key for Linux signing is different) and Secure Boot disable. Eh, I read reduced mode as basically how secure boot works on hardware with Microsoft-only keys in which MS signs a shim and it automatically blesses desendants (technically the OEM is not restricted to put other keys on the key database, but aside from business computers it seems that most machines have only Microsoft and OEM keys). Of course, Microsoft has a stronger incentive to sign these (or else they will be accused of antitrust violations), so Apple might not do that.