possible but difficult and not supported https://wiki.archlinux.org/index.php/Unified_Extensible_Firmware_Interface/Secure_Boot