Can’t find anything in both documents which allows booting of non Apple signed Software. The only thing I See there is something like SecureBoot on PCs, where Apple would need to sign your boot loader in order to be able to boot it.

--permissive-security is the setting that you want. You are then able to enroll hashes of unsigned kernels with kmutil.

Kmutil is only there to load kernel extensions? Or did that change with Big Sur?

It changed. You use kmutil create to create the artifacts and add the hash to the Secure Boot policy. (--help at https://pastebin.ubuntu.com/p/mN3Z2kfJWy/, no manpage)

TIL this has a man page