I had the same issue, so thank you very much for your help (both question and answer).
Just to bring up some of my own experience following your guideline :
chroot IS mandatory for it to work
when chrooting, you need to mount --bind /dev, /sys, /proc AND /run (the latter omitted in the link you mentioned)
If your removable device is not yet bootable, it may ...
When you use the grub-mkstandalone command, you need to pre-load the modules with --modules=module_list. secureboot can only use these modules in the list.
MODULES="all_video archelp boot bufio configfile crypto echo efi_gop efi_uga ext2 extcmd \
fat font fshelp gcry_dsa gcry_rsa gcry_sha1 gcry_sha512 gettext gfxterm linux linuxefi ls \
I might be mistaken, but I'd assume adding network server abilities to GRUB2 is out of scope for the project. The idea why you'd want a password-protected GRUB is that you want to enforce that someone is sitting in front of the computer to type in that password!
As you noted, if you want encrypted disks, but network access, an initramfs that contains some ...
Turns out it is very simple to achieve. the only problem is it is kind of confusingly documented.
here are the steps that you need to perform
install proxmox (using DEBUG mode) on your nvme drive (which may not
be bootable due to legacy BIOS)
once the install is complete, do not exit the install wizard, but start the command terminal. (Selecting debug mode ...