You can use custom keys with secure boot. Any PC newer than 2015 should give you that option.

You don’t have to use Microsoft’s keys.

This isn’t a secure boot issue. This is a bootloader issue.

Store now, decrypt later. Make sure your VPN is using quantum-safe encryption algorithms with perfect forward secrecy. They are storing ALL traffic that goes outside the country (probably domestic traffic too, realistically).