Dear Steve,I just upgraded shim-signed and shim-signed-common to version 1.39+15.7-1; but unfortunately, secure boot still fails with the same message.
I also turned on shim debug. A recording of the debug output, which is only visible when disabling secure boot in the (UEFI) BIOS, is available here:
https://www.van-roermund.nl/temp/boot_shim.mp4 (I hope the quality suffices.) Cheers, Timo