Are you aware of this?

[Hlsgs]

https://github.com/ValdikSS/Super-UEFIinSecureBoot-Disk

[pbatard]

Yes.

Its author has been kind enough to post here, and this was the very last link they provided (See #15). I am planning to investigate the use of a shim based on the points he raised.

However, at the moment, I am still not entirely convinced I want to go with a solution like that, because of how much including the base shims for all archs would make the size of the Rufus application explode (since UEFI:NTFS is targeted at being used in Rufus). But I'm definitely planning to have a closer look, when I get a chance.

I will close this issue then. Thanks for pointing me to Super-UEFIinSecureBoot-Disk, even if it was unnecessary.