Kernel lockdown vis-à-vis secure-boot

It might be orthogonal, but it is hella useful to have lockdown enabled automatically when secure booting. It's just a few lines. Sure, by all means, put it behind a disabled-by-default kconfig. But why take the feature away? Distros clearly like it and their customers want it, given it's been shipping for years.