You can create a version of grub which requires gpg signatures for everything it loads, including any modules, the initramfs and grub.cfg, then sign that versio

You can create a version of grub which requires gpg signatures for everything it loads, including any modules, the initramfs and grub.cfg, then sign that version of grub with a secure boot key. You'll possibly need to then sign your kernel twice (once with sbsigntool and once with gpg). I don't know if this meets your definition of "actually secure" but it does mitigate the issues around initramfs etc.