This isn't applicable to a UEFI Secure Boot system, where the shim and grubx64 binaries are distribution signed and installed from the package - not via grub2-i

This isn't applicable to a UEFI Secure Boot system, where the shim and grubx64 binaries are distribution signed and installed from the package - not via grub2-install, which on UEFI produces an unsigned binary and will not boot under UEFI Secure Boot.