As long as the bootloader/kernel image is signed, I don't think it matters to secure boot whether or not it was loaded off a USB stick. Presumably the firmware

As long as the bootloader/kernel image is signed, I don't think it matters to secure boot whether or not it was loaded off a USB stick. Presumably the firmware implementing the secure boot check must copy the image into RAM before verifying it anyway, at which point the USB storage doesn't matter. Of course, the firmware may be configured to refuse to boot a USB drive as a matter of policy.