[Nullabillity]

No, this shows why (forcing) Secure Boot was a bad idea. Allowing Shim to load unsigned kernels would be equivalent to having it bypass SB in the first place, which Microsoft would presumably never sign.