FWIW. The relevant source code in grub to honor MokSBStateRT setting. https://git.savannah.gnu.org/cgit/grub.git/tree/grub-core/kern/efi/sb.c#n94