What’s wrong with fwupd? I’ll admit that that the CLI is not exactly awesome, but it seems like a fairly clean implementation of the actual UEFI spec for updates.
Basically right now my setup is super simple and restricted and I have to make it significantly more complicated and insecure to allow fwupd to work.