Enable Secure Boot with Your own Keys

Using Secure Boot with Linux is quite a challenge because most mainboards only have Microsoft's own KEK and DB keys installed. There are possibilities like shim, but that's quite cumbersome and it won't work for macOS (if you are running a "Hackintosh"). Creating your own Secure Boot keys is the most elegant way and will work for Windows, Linux and macOS.

There is a great tutorial about signing EFI binaries using sbsigntools by Rod Smith, however this won't work with Apple's binaries. pesign from Red Hat is a better and more robust alternative in my opinion. It also brings its own keygen for creating compatible SSL keys and uses Mozilla's NSS to store them in a secure database. Neat!

GRUB Standalone with embedded config file and different keymap

It is possible to create a single GRUB EFI binary without any additional config files, modules, drivers, themes etc. on the boot partition. All those files will be put in a tar memdisk and then included into the binary itself, creating a "standalone" .efi file.
While that isn't really necessary for most users, it can be beneficial for full disk encryption scenarios.

GRUB is the only boot loader that can decrypt a LUKS blockdevice as of today.
However, in the standard configuration GRUB places its config files and drivers onto the boot partition. But on a fully encrypted disk, those files can't be read at boot.
Consequently no customization (e.g. changed colors, background, screen resolution) is available and one is greeted by an ugly password prompt before one can even chose what kernel or OS to boot.
Also, the decryption takes ages, even on a modern CPU. If you just want to boot a different OS on a dual boot machine this can be very tedious.