From a practical standpoint, feel free to just leave it off, nobody is going to go break into your house and bootkit your desktop computer. It'd be much easier to just steal it and sell for parts, or get you to run malware that steals your cookies or something.

If you still want secure boot, check the following:

• Are the Microsoft CA/KEK certs and an OEM PK installed? They should be on most normal motherboards, but perhaps your OEM decided to just not do that
  • The relevant ArchWiki article could help you with this, though it's quite technical at times, and you really shouldn't be using the 2011, but the 2023 certificates by now.
  • also very unlikely
• Does your default boot entry point directly at the Windows bootloader or is there something in between, like maybe HackBGRT, to make Windows look nicer?
• Is CSM enabled? Turn that off if you want secure boot
• Is your partition layout MBR? That can mess with it