Any Windows 10 PC you buy nowadays has secure boot enabled by default. Normally there is no reason turn it off for openSUSE as our bootloader and kernel is signed by MS. So far on openSUSE we did not require kernel module signing exactly for the reason to allow having custom modules like the NVidia driver. If we decide to change that on upgrade it deserves documenting.