Comment # 42 on bug 950569 from patrick shanahan

I also can boot my acer aspire 5 w/o rearranging order
but still have an "extra" entry:

acer: ~ # efibootmgr
BootCurrent: 0003
Timeout: 2 seconds
BootOrder: 0003,0002,0001
Boot0001* Windows Boot Manager
Boot0002* grub-secureboot
Boot0003* opensuse-secureboot

I confirmed that 0002 would also boot and then removed 
0002:

acer: ~ # efibootmgr -b 2 -B
BootCurrent: 0002
Timeout: 2 seconds
BootOrder: 0003,0001
Boot0001* Windows Boot Manager
Boot0003* opensuse-secureboot

and now have:
acer: ~ # efibootmgr
BootCurrent: 0002
Timeout: 2 seconds
BootOrder: 0003,0001
Boot0001* Windows Boot Manager
Boot0003* opensuse-secureboot

fwiw, I do not care which should have remained but whichever
was added unintentionally or incorrectly *should* have been 
automagically removed.  The incorrect situation was aleviated
but not completely corrected.  One *should* clean their trash.