How does secure boot in computers work, and how is the default Windows Secure Boot different from the Secure Boot of an alternate OS (such as Linux)?

Like... where does the default windows signing keys come from? Isn't that like hard embedded into the BIOS/UEFI when the hardware is made? If so, how does Linux even use Secure Boot? Does it somehow replace the keys when you install a new OS?

I tried googling, but all I find is just simple pages that doesn't have much detail.