1) Generate a key 2) Rebuild the shim loader with your key included 3) Choose "Secure boot option" in the firmware menu 3) Choose "Select a UEFI file as trusted for execution" 4) Select the shim loader from the menu
But this will vary between firmware vendors and system vendors.
Re: What if Microsoft won't sign the bootloader?
1) Generate a key
2) Rebuild the shim loader with your key included
3) Choose "Secure boot option" in the firmware menu
3) Choose "Select a UEFI file as trusted for execution"
4) Select the shim loader from the menu
But this will vary between firmware vendors and system vendors.