fyi, we are now distributing qemu-ovmf-secureboot as a supplementary orig tarball for edk2 so that we can use it to build secureboot ovmf images. It is still not provided in a binary package though. -dann