Peter checked (I asked him, since they have hardware that clearly exhibits the issue) and it looks like this is a verification-done:
grub2 2.02-2ubuntu8.6 grub2-signed 1.93.7
I still have to do a quick check with Windows 10 to make sure that aspect of the fix also works correctly, and that shim-signed has the right Breaks.
Peter checked (I asked him, since they have hardware that clearly exhibits the issue) and it looks like this is a verification-done:
grub2 2.02-2ubuntu8.6
grub2-signed 1.93.7
I still have to do a quick check with Windows 10 to make sure that aspect of the fix also works correctly, and that shim-signed has the right Breaks.