level of tweaking then it's probably totally OK to just turn of Secureboot, at which point you can change it freely.
The user having choice and the user having secure shouldn't be mutually exclusive. Also, if users have "special" hardware, shouldn't they also have security.