Garrett: Secure Boot and Restricted Boot

No, I don't think it works that way because the verification is done in the previous layer of code and there is no reliable signalling to the next layer signifying whether it did any checks at all.

Anything that can be booted in Secure Boot mode can also be booted without Secure Boot enabled and it won't know the difference. Your Secure Boot capable bootloader/kernel can't refuse to start on a non-Secure Boot enabled system, or one that is faking Secure Boot checking. For example a VM.