Hi!
I'm one of the members of the EFI team in Debian, responsible for
most of the UEFI packages in Debian, including shim.
I've backed out the changes you've made to the SecureBoot page here,
as I believe them to be misleading, overly-complicated and potentially
dangerous for users to follow.
To switch from a non-SB setup to a SB setup does not need people to
use a live image. Suggesting that people should clear the contents of
/boot/efi is both needless and *dangerous* - it will break any
dual-boot systems, for example. There's also no need to run
grub-install manually, and that may cause further issues.
The *right* way to switch (if needed), is simple. From a running
system:
$ sudo apt-get install shim-signed grub-efi-amd64-signed
That should do everything that's needed. If you find any places where
that does *not* work, please file bugs.
If you want to talk about issues here, please follow up on the
debian-efi mailing list (in CC).
--
Steve McIntyre, Cambridge, UK. steve@einval.com
"When C++ is your hammer, everything looks like a thumb." -- Steven M. Haflich