Quoting János Pásztor from https://github.com/grml/grml-live/pull/129:
After
581da7443c68c362a7677c905ab5c63eb23c5b73 and using the `debian`
style secure boot grml will not start on machines with secure boot
enabled, but fails with a `signature verification error`
After some investigation it turned out that we hit
https://bugs.debian.org/925550 with our boot binaries.
I have updated them from debian and managed to boot with them
properly.
While at it, switch from http://ftp.de.debian.org/ to
https://deb.debian.org/ which has proper SSL certificate available.
Thanks: János Pásztor <model87@freemail.hu> for bugreport and PR
-shimx64.efi.signed = /usr/lib/shim/shimx64.efi.signed from http://ftp.de.debian.org/debian/pool/main/s/shim-signed/shim-signed_1.33+15+1533136590.3beb971-7_amd64.deb
-grubx64.efi.signed = /usr/lib/grub/x86_64-efi-signed/gcdx64.efi.signed from http://ftp.de.debian.org/debian/pool/main/g/grub-efi-amd64-signed/grub-efi-amd64-signed_1+2.02+dfsg1+20+deb10u2_amd64.deb
+shimx64.efi.signed = /usr/lib/shim/shimx64.efi.signed from https://deb.debian.org/debian/pool/main/s/shim-signed/shim-signed_1.38+15.4-7_amd64.deb
+grubx64.efi.signed = /usr/lib/grub/x86_64-efi-signed/gcdx64.efi.signed from https://deb.debian.org/debian/pool/main/g/grub-efi-amd64-signed/grub-efi-amd64-signed_1+2.06+7_amd64.deb
# NOTE:
# shimx64.efi.signed ends up as /EFI/BOOT/bootx64.efi inside [grml_cd]/boot/efi.img, and
# grubx64.efi.signed ends up as /EFI/BOOT/grubx64.efi inside [grml_cd]/boot/efi.img, whereas
# NOTE:
# shimx64.efi.signed ends up as /EFI/BOOT/bootx64.efi inside [grml_cd]/boot/efi.img, and
# grubx64.efi.signed ends up as /EFI/BOOT/grubx64.efi inside [grml_cd]/boot/efi.img, whereas