If it's signed with Secure Boot keys it's no different for loading signed Grub image. Grub would also need to be unencrypted to work. As for signing kernel: ht

If it's signed with Secure Boot keys it's no different for loading signed Grub image. Grub would also need to be unencrypted to work. As for signing kernel: https://github.com/andreyv/sbupdate https://github.com/andreyv/sbupdate