Probably integrating something like sbctl (https://github.com/Foxboron/sbctl#sbctl---secure-boot-manage...) would do the trick, it's making the whole signing and key management dance easy.
Seems to already work together with limine on NixOS too: https://search.nixos.org/options?channel=25.11&query=sbctl#s...
you must not join it, refuse to lockdown your computer
Do people still think you need to have your boot program signed by Microsoft in order to use it?
I also wonder if this sentiment is what stalled development in other more traditional projects like BSD derivatives. I'd love to have FreeBSD with secure boot and loading ZFS keys from the TPM.
https://learn.microsoft.com/en-us/windows/security/operating...
However OEM's like HP are ignoring the certification requirements:
https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-...
https://h30434.www3.hp.com/t5/Notebook-Boot-and-Lockup/How-t...
