With a little of spare time this morning, I was able to (finally) install Fedora 39 on my Microsoft Surface Pro 3 with Secure Boot enabled using a bootable USB stick with an older version of BOOTX64.EFI. [1]
I had to temporarily disable TPM in order for the system to boot after the install. Resetting the Secure Boot keys to Microsoft and Third-Party keys and re-enabling TPM [2] after installing the latest updates allowed me to boot back into Fedora with both TPM and Secure Boot enabled.
Since I still wanted a computer that ran KDE Plasma, I went with the KDE spin.
The Surface is definitely a bit tired and slow, but still very usable for browsing the web and editing documents.
