The problem appears to be that Intel hasn't provided a platform key in the firmware, which I think they're supposed to do. (Or at least there should be the provision to generate one.) The same problem is also present in the latest BIOS release for the DH77EB.
Half the trouble is that reliable, informed details about Secure Boot are pretty thin on the ground and frequently contradictory. The Linux Foundation, for example, recommends: "To enable proper operation with open systems, all UEFI secure boot platforms should ship in setup mode, with no Platform Key installed. This enables the Platform Owner to take control of the platform securely by installing their own platform key or allowing the Operating System install process to do so."
You should actually be able to install a platform key in Windows 8 using the Format-SecureBootUEFI and Set-SecureBootUEFI PowerShell cmdlets, but it's a lot of faff for a standalone system and I haven't tried it. Fine for enterprises, but in my opinion the whole process should be either invisible or self-explanatory for regular users or it runs the risk of Secure Boot just being completely unused or - even worse - many users assuming they have Secure Boot enabled when they actually don't.
As far as I can see, then, in our situation the problem here is being caused by Intel. Who knows whether it's a bug, oversight or actual design decision? If anyone from Intel is reading this thread, I'd be very interested to hear their opinions.