Interesting, I have a 430 G2 I occasionally use as a media player, and it's the only one on which I never attempted to install anything else besides Ubuntu or W

Interesting, I have a 430 G2 I occasionally use as a media player, and it's the only one on which I never attempted to install anything else besides Ubuntu or Windows, so never had to deal with Secure Boot. I actually don't even know if it's on or off. On newer models, you also have to "clear the certificate cache" to enroll your own keys. But there's an option on the same page like "reset to factory defaults", which reloads the MS keys and such. The manual UEFI update is indeed a bit cumbersome, especially since the downloaded archive seems to be some windows executable. And, in my case, I don't remember I could navigate in the partitions, it would just complain that it couldn't find the update if it wasn't in the right directory.