I have sent a submit request to openSUSE:Factory/shim for detecting the --set-sbat-policy before using it: https://build.opensuse.org/request/show/993204