debian wiki shows example hw/machines that is buggy
https://wiki.debian.org/SecureBoot/BuggyFirmware
so single signed binary for the rescue!
https://sources.debian.org/src/shim-signed/1.51/shimx64.efi.signed.MS-2023
and put grub-efi-amd64-signed or systemd-boot-efi-amd64-signed as grubx64.efi, you can prepare a boot drive with that.
mirror dl can be found from ubuntu source
https://git.launchpad.net/ubuntu/+source/shim-signed/tree/?h=debian/sid