That's pretty dope! I imagine we'll see more distros follow suit as the September expiration of Microsoft's keys approaches.

My distro, openSUSE Tumbleweed, does that as well, but I imagine plenty don't.

Edit: I'm wrong, looks like they do that for "Trusted Boot," but not "secure boot," if this documentation is to be believed. It's an option, not forced. I'm going to check later if it's configured properly on my machine that I set up several years ago.