Comment 6 for bug 1799767

Output of apport-collect now is
Package shim-signed not installed and no hook available, ignoring
Gtk-Message: 21:00:40.534: GtkDialog mapped without a transient parent. This is discouraged

And yes, it's true, at the moment it is not installed and the behaviour is as I described first.
But I'm sure, that the behaviour was the same when shim-signed had been installed some days ago. If you want, I can install it, try reeboot with CSM enabled and with CSM disabled and tell, what I have found out then.