It seems the solution is to change the UEFI settings:

https://download.lenovo.com/pccbbs/mobiles_pdf/Enable_Secure...

Better articles about the same problem:

https://mjg59.dreamwidth.org/59931.html

https://www.phoronix.com/news/Lenovo-Pluton-Windows-Default