IMHO, the alternatives are:
1) boycott so-called "secure" boot, altogether (everywhere);
2) find a way to add and/or replace a key in the firmware, in order for the PC owner (root user) to personally sign every piece of software he has to be signed.