What a terrible system. I have a couple of computers where the vendor provides good update support, but for most of them this is not the case and you're pretty much stuck with the firmware you get. To tie Secure Boot to such a flaky set of distribution channels seems like very poor planning.