Comment # 3 on bug 1190261 from Michal Suchanek

There is no way to detect shim is used just like there is no way to detect
secure boot is being used. Just like secure boot is enabled always and option
to opt out is offered call mokutil always and offer configuration option to opt
out.

While it is possible to detect if secure boot is enabled for specific boot and
it's probably possible to detect if specific boot went through shim as well it
is common to disable system features for testing and troubleshooting, and if
that changed how kernel and modules are installed it would make the boot state
even more complex and harder to understand than it already is.