Comment # 7 on bug 950569 from Neil Rickert

I'm changing the status to "confirmed".

That "grub-secure-boot" entry is actually a mistake (see bug 948866 ). 
However, it should work to avoid the latest problem.

You can probably change which entry is default, using

efibootmgr -o 2,1,3

(but use the boot entry numbers that are shown for you).  This sets the boot
order.  You probably want that grub-secure-boot to be first, and Windows
second, at least for now.