I’ve tested the beta yesterday and only had to enable SB and leave it in custom mode - no need to sign & enroll the linux kernel(s) too