Hey Matthew, I've reported a bug in the (your?) kexec secure boot implementation with regards to custom platform keys in march: https://bugzilla.redhat.com/show_bug.cgi?id=1554113, but unfortunately have not received any responses (even though another user confirmed the bug).
secure boot kexec not trusting secondary trusted keys
I've reported a bug in the (your?) kexec secure boot implementation with regards to custom platform keys in march: https://bugzilla.redhat.com/show_bug.cgi?id=1554113, but unfortunately have not received any responses (even though another user confirmed the bug).
Could you please have a look at it?