Secure boot means only signed code can run in the kernel/ring 0. Grub, as the loader, needs to be signed as well. Basically anything with system privileges needs to be signed. If I remember right you need to enroll the signing key on installation, and the rest is handled automatically, but you can't use any custom kernel or kernel drivers.