bzImage has invalid signature

error: you need to load the kernel first

Even with a successful chain shim -> grub displaying GRUB menu you can see the invalid signature error when you are trying to load a custom kernel.

The reason

Since the most recent GRUB2 update (2.02+dfsg1 in Ubuntu), GRUB2 does not load unsigned kernels anymore