Sadly, yes, it's too late to fix it. It's part of the UEFI spec, the relevant version of which was released last year. At the time, it didn't seem objectionable - we'd been under the impression[1] that this was going to be opt-in functionality, at which point the signature management becomes local policy. Microsoft's policy was dropped on top of this last August, after spec adoption had already begun.

[1] And it turns out we weren't the only ones...