It actually seems pretty reasonable. The only big problem I see is that Microsoft is the signing authority, but hey -- no one else wants to do it, so what's the other option?

I suspect all of the kernel developers will be comfortable with navigating EFI and turning secure boot off. All this solution does is make it so normal users don't have to do that.