Oh, well, if it requires a password that is pretty much solved. The original commentor made it seem a lot less hands on.

I was under the impression that the shim let OS's boot all the way up, and that it was just a standard part of the boot process, I was suggesting instead that the signed binary only let's you add a new key, which you can then use to boot without the shim.

Doesnt help when the key expires though.

Thanks for the additional info, greatly appreciated.