I think this is not general enough. What would be needed is the Microsoft secure boot private key so we can just sign EFI binaries and have them work everywhere

I think this is not general enough. What would be needed is the Microsoft secure boot private key so we can just sign EFI binaries and have them work everywhere without mucking around in the bios setup. Afaiu, this key is specific to certain generations of Intel CPUs.