Why is systemd-boot not signed?

[navras]

I misspoke about the alternative. It might not be as tedious as it sounds.

Moving from GRUB to systemd boot

I think the reason you had to sign the kernel (on every update) is that you signed systemd-bootx64.efi instead of shim. shim has built in Fedora key to backdoor the Secure boot process to trust Fedora key, even if it’s not in key db. If you sign shim, the boot goes: shim (your key, or Microsoft) → sd-boot (Fedora) → kernel (Fedora). But you didn’t sign it and removed the Microsoft key, the boot likely doesn’t allow shim, so it goes: sd-boot (your key) → kernel (must be your key). I think it m…