die panikmache um die secureboot certs ist ein ziemlicher nothing burger. sag nicht ich, sondern die treibende kraft hinter secure boot für linux:

But if we look more closely at that certificate, we learn that it was issued in 2023 and expired in 2024. Older versions of Shim were signed with older intermediates. A very large number of Linux systems are already booting certificates that have expired, and yet things keep working.

(er hat auch fleißig drüber gemastodont, aber das lässt sich nicht durchsuchen)