Another option for NixOS is bootspec-secureboot, I'm using it with no real complaints: https://github.com/DeterminateSystems/bootspec-secureboot
Please, people, if you release software that overlaps or competes with another existing in the space, take the 3 minutes to write a comparison note or "why this exists". Please.
Unfortunately, unlike many of their projects, they don't seem to have a blog post yet for it.
It seems like a natural conclusion to spend a fraction of the energy to author, to detail it's reason to exist.
Anyway, no one owes me anything but I trust that Determinate Systems has a grander vision than I can see, I just want to be clued in, to be honest ;).