I can build a 64-bit efi grub2 boot file using
grub-mkimage under Linux-Mint.
But I want to make one that I can use with the signed shim
bootx64.efi - signed shim (e.g. from Ubuntu)
grubx64.efi - grub2 (e.g. from Ubuntu)
This boots in Secure Boot mode OK. But if I substitute the
grubx64.efi file for the one I build, it only boots in non-Secure-boot mode.
grub-mkimage script seems to have a provision for a public key. Is this what I need to add. If so, where do I get the key from and how do I add it?