The script Invoke-AutopilotPrereqChecks.ps1 is great. Maybe extent it with a check about the secure boot mode. Confirm-SecureBootUEFI