uefisign signs loader.efi, and `uefisign -V` says it's signed:
```
$ uefisign -Vv loader.efi.signed
file contains signature
computed SHA256 digest a2fad11ba39e04c55ec6480f06f45e467388eab1fea6fb59e8e7e39b602aaf00; digest len 32
to dump PKCS7:
dd if='loader.efi.signed' bs=1 skip=898568 | openssl pkcs7 -inform DER -print
to dump raw ASN.1:
openssl asn1parse -i -inform DER -offset 898568 -in 'loader.efi.signed'
```