$ kmutil configure-boot -c loader.macho

loader being a Mach-O executable that iBoot will jump to. After that everything is for you.

Note: the command should be executed from macOS 1 True Recovery (hold the power button for the first few seconds at boot up) to downgrade the security policy.