Shim is there for Secure Boot. Microsoft refused to sign grub (GPL-3), but signed the shim (BSD-2), so shim has its own key store and verifies grub signed by re

Shim is there for Secure Boot. Microsoft refused to sign grub (GPL-3), but signed the shim (BSD-2), so shim has its own key store and verifies grub signed by respective distros. If you don't use Secure Boot, UEFI firmware can boot directly to grub.