To be precise, having an optional secure boot is required for the Windows logo certification. If it cannot be disabled, no logo certification.
See "Windows Hardware Certification Requirements for Client and Server Systems" [1], requirement "System.Fundamentals.Firmware.UEFISecureBoot", items 17 and 18.
> On non-ARM systems, it is required to implement the ability to disable Secure Boot via firmware setup.
To be more precise, this is only true for non-ARM systems. This is evil, since it's entirely possible to have an ARM desktop/laptop, and I really hope there's some kind of anti-trust legislation here. At least Apple offers a way to boot into an alternative OS, even though it is still a bit locked down.
See "Windows Hardware Certification Requirements for Client and Server Systems" [1], requirement "System.Fundamentals.Firmware.UEFISecureBoot", items 17 and 18.
[1] http://msdn.microsoft.com/en-us/library/windows/hardware/jj1...