As I understand it, it's Microsofts attempt to only allow booting kernels signed by them or their partners. In theory this stops malicious attacks from changing the kernel and have it booted. But Secure Boot is just something you can turn off.