Supported path for Secure Boot: shim + enrolled MOK, or is db signing (sbctl) the only route?

[kldload]

I'm trying to boot ZFSBootMenu with UEFI Secure Boot enabled on Fedora 44, keeping the distro's existing shim/MOK chain rather than enrolling custom platform keys. The docs cover UEFI booting but don't mention Secure Boot, and I couldn't find this asked anywhere, so I may be attempting something that isn't a supported shape.

Setup

• Fedora 44, root-on-ZFS, ZFS 2.4.3, shim-x64 16.1
• Secure Boot on, Microsoft keys intact
• A local MOK is enrolled and demonstrably trusted: the same key signs the zfs kernel module, which loads fine under Secure Boot
• ZBM is the prebuilt EFI from https://get.zfsbootmenu.org/efi, signed with that MOK using sbsign

What I tried

1. Chainload from GRUB — chainloader /EFI/zbm/BOOTX64.EFI. Refused, which I now understand is expected: shim won't verify an arbitrary image handed to it via chainloader.

2. ZBM as shim's second stage. shim (shimx64.efi) copied to /EFI/zbm/BOOTX64.EFI, ZBM as /EFI/zbm/grubx64.efi (the loader name Fedora's shim looks for, confirmed in its UTF-16 strings), mmx64.efi alongside, and a dedicated efibootmgr entry pointing at the shim.

Result: Verification failed: (0x1A) Security Violation and MokManager offering to enrol the failing image's hash.

What I've ruled out

• Signature is valid. sbverify --cert mok.pem zbm.efi → Signature verification OK, and the embedded cert subject matches the enrolled key exactly.
• Key is enrolled. It appears in mokutil --list-enrolled, and the same key's signature is accepted for kernel modules under the same Secure Boot session.
• SBAT is not revoked. ZBM's .sbat declares systemd-stub,1,... and systemd-stub.void,1,...,256.6_2; mokutil --list-sbat on this firmware lists only sbat,1,2024040900, shim,4, grub,4, grub.peimage,2 — no systemd-stub entry.

So: a correctly signed image, by an enrolled key, with unrevoked SBAT, in the layout shim expects, still gets 0x1A.

Questions

1. Is shim + enrolled MOK a path anyone has working with the prebuilt EFI? pass -a option to kexec to support secure boot #228 suggests at least one person booted ZBM under Secure Boot, but doesn't say how the image was trusted.

2. Is the prebuilt release EFI expected to be signable as a shim second stage at all, or does the systemd-stub UKI layout make that a non-starter — i.e. is generating a UKI locally via generate-zbm the only viable route?

3. If the answer is that db signing with custom platform keys (sbctl) is the only supported approach, that's a completely reasonable answer and I'll take it — a line in the UEFI docs saying so would have saved me a fair amount of time, and I'm happy to submit that doc patch.

I have shim verbose output available if it would help, though it's a lot of hex; happy to capture the relevant portion if you can say what to look for.

Thanks!