After discussion with grub2 expert, Michael Chang in mail, I removed POST_PROCESS_PE_FLAGS=-N from the build command in shim.spec to enable the NX compatibility flag. It's useful for further development and testing. The submitreq is here: https://build.opensuse.org/request/show/1078224