@niggy I can't believe it took me this long to figure it out.

I am 100% confident that all UEFI signing schemes are 100% compromised by the NSA and/or other intelligence agencies, as bypassing Intel boot guard or secure boot etc is as easy as paying such companies a few million for the signing keys to get them to hand them over, or cracking into the relevant computers and extracting the keys (only mildly difficult for the NSA to pull off).

I would suggest relying on free software signing schemes with keys that you control, over proprietary software signing schemes with keys controlled by the NSA and ?? other parties.