Comment 65 for bug 1574727

The update of shim, grub, mokutil and others to use signed kernels and modules are mostly done; one further step that needs to happen is to have grub enforce that kernels are properly signed, and refuse to load unsigned kernels (rather than falling back from the linuxefi module which checks signatures, to linux which doesn't).

In the interest of clarity, I'll close the tasks here as Invalid for what is left as "New", and we'll move this "last step" to bug 1401532 which is clearly about this issue.