1. In SecureBoot grub2 allows to exit secure mode and boot unsigned kernel - making use of this feature in iso grub config.