I'm not sure about Windows specifically, I just know you can load your own keys onto the mobo. In general, a cryptographic signature is just metadata tacked onto a file, so presumably yes, you could sign the kernel yourself and load your key so Secure Boot works.

The way Linux distros generally work (e.g. Debian) is to use a shim binary and chain load into their own kernel binary. An exerpt:

Starting with Debian version 10 ("Buster"), Debian supports UEFI Secure Boot by employing a small UEFI loader called shim which is signed by Microsoft and embeds Debian's signing keys. This allows Debian to sign its own binaries without requiring further signatures from Microsoft.

So even if signing the Windows kernel doesn't work (I don't see why it wouldn't), you could use a loader shim like Debian does to not require loading your own keys.

To be fair, I haven't read the details of Secure Boot specifically to know how it's done, I'm just going based on my understanding of PGP (about how signing works), early kernel boot, and high level details about Secure Boot. I'm sure someone sophisticated enough to design kernel-level game cheats could figure out how to make Secure Boot happy without a ton of effort from users.

Secure Boot isn't designed to prevent users from doing things, it merely prevents malicious code from being loaded at boot (i.e. code that doesn't have access to the keys loaded onto the Secure Boot module).

You can, but it probably needs a key related to Microsoft certificates