With a bootloader signed using Microsoft keys, or a bootloader that needs a MOK to be set up to install third-party keys in the Secure Boot database?
I did the latter and it was a pretty annoying process that would scare away beginners—hence me saying a "workaround" was possible. I'm not using a common distro like Fedora or Ubuntu, though. Is setting it up less painful on those?