Grub Secure Boot | via sbctl

[Sameguyy]

GRUB 2:2.12.r292.g73d1c959-1
arch
If it's not too much trouble, please help me understand how to sign the grab so that it works. I've been trying to understand something for 3 days now, but without success.

It seems like all the files are signed, but grub continues to be naughty
https://bbs.archlinux.org/viewtopic.php?pid=2258224#p2258224
here I was advised a couple of commands, but now I wondered, why he asked me to use grub-mkimage, because grub-install does it anyway

[root@ArchLinux ~]# sbctl verify

Verifying file database and EFI images in /boot...
✓ /boot/EFI/BOOT/BOOTX64.EFI is signed
✓ /boot/EFI/grub/grubx64.efi is signed
✓ /boot/grub/x86_64-efi/core.efi is signed
✓ /boot/grub/x86_64-efi/grub.efi is signed
✓ /boot/vmlinuz-linux is signed
✓ /boot/EFI/GRUB/grubx64.efi is signed

List of signed files, with this list of signed files
i can boot in GRUB, grub looks broken visually, like some fonts didn't load, but it's readable
When I try to boot into the system GRUB gives an error
error: verification requested but nobody cares & need to boot kernel first

Foxboron/sbctl#455 (comment)