Struggling with vendors that cater mostly for MS Windows users who
don't really care about Secure Boot being disabled or not, is not the
way that leads to an available solution. Such vendors are far too
powerful to bow to the pressures of insignificant pressure groups like
'old fashioned' Linux users who do not want to use a 'modern
distribution'. What I would do, is dedicate a small partition to hold
a distribution that can actually boot in Secure Mode and I would use
that to manage my bootloader.

You have the choice of at least two major distributions that work
under Secure Boot. These are Ubuntu and Debian.

This solution was what I did when GRUB 2 started to behave obstinately
refusing to install its first stage when completely stripped of an
operating system.