I’ve done a little research and I feel like I would need an configurable pxe-loader option, to seperate the boot files for different OS Types within the tftpboot directory. I.E. /var/lib/tftpboot/$OS/grub2 and so so on. Since secureboot files might be named the same but contain diffenrent signatures. Maybe this is somthing to consider for redesign
