> signed shim

How would they sign such a shim without my keys? I don't leave Microsoft keys enrolled on my laptop.

You don't but 99.99% of people do :) Especially because most Linux distros use a key signed by Microsoft by default.