You won't HAVE to, but it might make it easier at first. The kernel module for the drivers simply needs to be signed and then secure boot will be happy. I've done it for debian before but can't find the exact piece of documentation explaining how to sign the kernel module.

Edit: Debian Guide

No, the installer should sign the new kernel in the process.

Bottleneck is if your UEFI allows adding custom keys. Fedoras normal GRUB is signed by Microsoft and thus works everywhere, but for this you need support for custom keys.