Bug#909718: debian-live: bootia32.efi + UEFI32 + SecureBoot => certificate error

[beta-tester <alphs-beta-release@gmx.net>]

Package: debian-live
Severity: normal

Dear Maintainer,

i have a tablet/netbook with:

- 32bit UEFI (only),
- SecureBoot enabled,
- 32/64bit CPU,
- Windows 10 Pro (32bit)

i can't use the live-dvd 64bit, 32bit version nor the multi-arch (debian-9.5.0-amd64-i386-netinst.iso) to boot LiveDVD or LiveUSB,
because bootia32.efi on the Live iso media isn't signed properly.
i get a signed certificat error at boot time from UEFI.

on a PC with 64bit UEFI and SecureBoot enabled i don't have that problem.

why is the bootx64.efi signed properly for SecureBoot an UEFI 64bit,
but bootia32.efi isn't signed properly for SecureBoot an UEFI 32bit ?

i tried the folowing iso images:
debian-9.5.0-amd64-i386-netinst.iso (it has /efi/boot/bootia32.efi and bootx64.efi, but not signed properly for UEFI32 + SecureBoot)
debian-live-9.5.0-amd64-lxde.iso (it has no bootx64.efi and no bootia32.efi at all)
debian-live-9.5.0-i386-lxde.iso (it has no bootia32.efi at all)

i don't knbow where in which package the issue is.
shim-signed, grub-efi-ia32-signed*, live-*, or where even


-- System Information:
Debian Release: 9.5
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-7-amd64 (SMP w/8 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)