The Free Software Foundation (FSF) has published a whitepaper suggesting how free operating systems can deal with UEFI secure boot. In the whitepaper the foundation criticized Canonical/Ubuntu for the approach they have taken in order to deal with the UEFI Secure Boot.

As well known Ubuntu solution, just like Fedora, also requires Microsoft key to be installed on the machine. As FSF points out Ubuntu's plan addresses software distributed through three different channels:

1) Machines sold as "Ubuntu Certified," preinstalled with Ubuntu, will have an Ubuntu-specific key, generated by Canonical, in their firmware. Additionally, they will be required by the certification guidelines to have the Microsoft key installed.
2) Ubuntu CDs, distributed separately from hardware, will also depend on the presence of Microsoft's key in the machine's firmware to boot, when Secure Boot is active.
3) Ubuntu bootloader images distributed online from the official Ubuntu archive will be signed by Ubuntu's own key.

FSF's John Sullivan writes that their main concern with Ubuntu's solution is the dropping of Grub 2, which is licenced under GNU GPLv3, in favour of another bootloader with a different license that lacks GPLv3's protections.

John writes:

Their stated concern is that someone might ship an Ubuntu Certified machine with Restricted Boot (where the user cannot disable it). In order to comply with GPLv3, Ubuntu thinks it would then have to divulge its private key so that users could sign and install modified software on the restricted system.

John clarifies that this fear is unfounded and based on a misunderstanding of GPLv3. He criticized Ubuntu/Canonical that "no representative from Canonical contacted the FSF about these issues prior to announcing the policy."

John writes:

Furthermore, addressing the threat of Restricted Boot by weakening the license of the bootloader is backwards. With a weaker license, companies will now have a form of advance permission to obstruct the user's ability to run modified software. Rather than work to make sure this situation does not happen -- for example by enforcing the proper Secure Boot implementation they say they "strongly support in [their] own firmware guidelines" -- Ubuntu has chosen a path which explicitly allows Restricted Boot.

FSF further says in the whitepaper:

It is not too late to change. We urge Ubuntu and Canonical to reverse this decision, and we offer our help in working through any licensing concerns. We also hope that Ubuntu, like Fedora, will actively support users generating and using their own signing keys to run and share any versions of the software, and not require users to install a key from Canonical to get the full benefit of their operating system.

You can check out the entire recommendation here.