No, I said that if the patch to set default policy wasn't accepted distros would have to enable it regardless of whether or not secure boot was enabled, so if you wanted to be able to disable it you'd need two kernels. Obviously the one that has lockdown disabled wouldn't be signed, because that would defeat the point. Secure Boot can be disabled on all systems running shim.

how can you disable the printing of the command line at boot time of a signed kernel?

By adding the "quiet" argument?