I just noticed this nice document on Ubuntu security features, maybe it is new, maybe I never noticed it before:
https://wiki.ubuntu.com/Security/Features#secure-boot
I also notice this page, which I believe has recently been updated:
DKMS modules need to be configured to work with UEFI Secure Boot
Ubuntu is now checking module signing by default, on kernels 4.4.0-18.34, 4.4.0-21.37, 4.2.0-42.49, 3.19.0-65.73 and 3.13.0-92.139 onwards. You can read more details in this bug in Launchpad. Because of those changes, DKMS modules will not work on systems with Secure Boot enabled unless correctly configured. In order to make DKMS work, Secure Boot signing keys for the system must be imported in the system firmware, otherwise Secure Boot needs to be disabled. There are several methods to configure your system to properly load DKMS modules with Secure Boot enabled.
https://wiki.ubuntu.com/UEFI/SecureBoot/DKMS
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1566221
