Yeah, exactly. This is why you still need to sign kernel images if using Secure Boot with systemd-boot. Personally the only reason I have it in the loop is it

Yeah, exactly. This is why you still need to sign kernel images if using Secure Boot with systemd-boot. Personally the only reason I have it in the loop is it makes it so much easier to switch the an lts kernel if say... zfs has failed to build on a kernel update and I didn't notice (not that THAT would ever happen). Could use multiple EFI entries for that, but systemd-boot is simpler.