Fedora's grub2 currently calls back into shim in order to perform the key validation, since otherwise the code would need to exist in both. The easiest thing to do is just to use shim, but sign it yourself.