Ubuntu is currently shipping using shim, albeit an older branch without the MOK functionality (I . The only real difference in security policy is that Ubuntu don't insist on signed modules, which is a policy decision that's made after the bootloader stage.