Yes. Debian ships with shim-signed which has been signed by Microsoft UEFI CA & will in turn boot grub-efi-amd64-signed which will then boot a signed kernel. So

Yes. Debian ships with shim-signed which has been signed by Microsoft UEFI CA & will in turn boot grub-efi-amd64-signed which will then boot a signed kernel. So you have a chain of trust from a standard UEFI system to the kernel. All of this is installed by default with a normal Debian install.