Looks like the sbverify command failing is not relevant. Retrying to boot with secure boot enabled in BIOS _after_ I downgraded shim/shim-signed to the versions that are in the archive for Xenial(updates pocket) was successful and brought up mok manager once, allowing to again disable secure boot at that stage (since I still need to use some DKMS packages and want to try test kernels).
So the main problem were those incorrect versions:
Looks like the sbverify command failing is not relevant. Retrying to boot with secure boot enabled in BIOS _after_ I downgraded shim/shim-signed to the versions that are in the archive for Xenial(updates pocket) was successful and brought up mok manager once, allowing to again disable secure boot at that stage (since I still need to use some DKMS packages and want to try test kernels).
So the main problem were those incorrect versions:
shim 0.9+1474479173. 6c180c6- 0ubuntu1 -> 0.8-0ubuntu2 14.04.1+ 0.9+1474479173. 6c180c6- 0ubuntu1 -> 1.19~16. 04.1+0. 8-0ubuntu2
shim-signed 1.21.4~