Ok, this is for sure a great way to make live distro images boot. But what about grub-install (grub-mkimage...) grubx64.efi files? These files seem to contain information about where is the "root" (grub root) partition, in particular the variables "root" and "prefix" change from system to system. So, if this file changes from system to system and is generated during the install process, how is one supposed to have it signed without disclosing the private key?
And how about grub-install generated .efi files?
But what about grub-install (grub-mkimage...) grubx64.efi files?
These files seem to contain information about where is the "root" (grub root) partition, in particular the variables "root" and "prefix" change from system to system.
So, if this file changes from system to system and is generated during the install process, how is one supposed to have it signed without disclosing the private key?