Comment 5 for bug 1890672

Thank you Don for setting the record straight re shim!

I too installed my own secure boot keys following this tutorial: https://wiki.gentoo.org/wiki/Sakaki's_EFI_Install_Guide/Configuring_Secure_Boot . And upon the grub upgrade from 2.04-1ubuntu26 to 2.04-1ubuntu26.2, my machine failed to boot as well with the same invalid signature message. The complete message read:

Loading Linux 5.4.0-42-generic ...
error: /boot/vmlinuz-5.4.0-42-generic has invalid signature.
Loading initial ramdisk ...
error: you need to load the kernel first.

I do not have shim installed, precisely because I did not want to use the Microsoft keys.
My setup (full disk encryption and secure boot) worked since May 2019. I could have done without the adrenaline buzz when it suddenly stopped working. Downgrading all installed grub packages to 2.04-1ubuntu26 made the system work again. Thank you Kyle for documenting that!