Sign kernel, grub and shim Debian packages on OBS
Also build a Debian live image which will be live-secure-bootable - get the SSL cert via "GPG Key / SSL Certificate" button or via the command line and convert it from PEM to DER format:
osc signkey --sslcert home:bluca:debian_secure_boot > obscert.pem
openssl x509 -in obscert.pem -inform pem -outform der -out obscert.der
and then add it to the UEFI DB list via the firmware (tianocore on QEMU) to test it.
There is also an ONIE.bin image that can be booted from the ONIE installer. It supports Secure Boot as well, as the kernel and modules are signed. The certificate from above needs to be added to the ONIE firmware.