I prefer legacy to UEFI because it's easier to move the OS from the installation SSD to the mdadm RAID0

Disable Secure Boot. Security technologies included in UEFI such as Secure Boot can be a blocker and prevent the system from booting external storage sources. Disabling Secure Boot, temporarily—normally accessible under the security menu or tab—will often resolve this.

I suppose it means 2 things, first, you get official support and warranty, and second, the distros will be Secure Boot approved in the UEFI, instead of distro makers having to figuratively ask Microsoft for pretty please permission.

Future kernel updates would require the updated kernels to be signed again, so it makes sense to put the signing commands in a script that can be run at a later date as necessary. A sample script /root/module-signing/sign-vbox-modules is given below.

Offer Secure Boot which means everything you load before an OS is loaded has to be signed. This gives your system an added layer of protection from running malware.

Sakaki's EFI Install Guide/Configuring Secure Boot