For reference, secure boot is pretty easy if you have a kernel with a combined initramfs, command line, and efi stub loader. You just sign the kernel with your EFI key, and you’re good to go.

You don’t even need to build your own kernel to do this. You can use your distro’s kernel and patch it with objcopy.