Expiring signing CA in 2026 (Microsoft Corporation UEFI CA 2011) - documented migration path?

Looking at Debian bookworm's shipped shim-signed packages, it looks like shim is still signed by

"Microsoft Corporation UEFI CA 2011"

which will expire in Oct 2026. At some point, shim would need to be signed by the successor

"Windows UEFI CA 2023"

at some point before that.

This change is non-trivial - either the loader can be signed by both CAs in the overlap time (if carrying two sigs is foreseen in the SecureBoot spec) or the signature changes hard with a next release.

It would be good to document publicly what the strategy is, and when it is to be executed.

For example, the PC I have is a bit older, and only has the 2011 CA in its SecureBoot trust store. There are also no UEFI updates coming any more that would add the 2023 edition (and it doesn't run Windows at all, so no Windows Update can add them).

Unannounced signature changes would break the boot after update; I will need to find a way to add the new CA to the trust store in some manual way. Assuming I'm not the only person with this problem, everyone in this situation would have an unpleasant day unless pre-warned properly.

No file or test is named. Start by reviewing Debian bookworm's shipped shim-signed packages and the issue's 2011 and 2023 UEFI CA compatibility concerns; done means publishing the signing strategy, execution timeline, and migration warning for systems that cannot add the 2023 CA.