Verification-done for xenial with grub2 2.02~beta2-36ubuntu3.12 and grub2-signed 1.66.12:
Booting behaves correctly with Secure Boot enabled or disabled; and when Secure Boot is enabled but shim validation is disabled. Booting in the chainload case could not be tested (I do not have a Windows key to test with, will attempt to resolve this situation).
Verification-done for xenial with grub2 2.02~beta2- 36ubuntu3. 12 and grub2-signed 1.66.12:
Booting behaves correctly with Secure Boot enabled or disabled; and when Secure Boot is enabled but shim validation is disabled. Booting in the chainload case could not be tested (I do not have a Windows key to test with, will attempt to resolve this situation).