If the disc is encrypted (and otherwise nothing would save you anyway), why do I need the Secure Boot, really? What harm it can do for somebody to boot my device from an unauthorized drive?
The threat model is the Evil Maid Attack.
I found Secure Boot + UKI + TPM PIN (God forbids automatic unsealing) + FDE to be great for both security and usability.
