If you look at the UEFI requirements for Windows 10[1], specifically clauses 19 and 20, it says for non-ARM systems the user MUST be able to put Secure Boot into Custom signature-checking mode.

[1] https://msdn.microsoft.com/windows/hardware/commercialize/de...