Comment by vetinari

Shim is there for Secure Boot. Microsoft refused to sign grub (GPL-3), but signed the shim (BSD-2), so shim has its own key store and verifies grub signed by respective distros.

If you don't use Secure Boot, UEFI firmware can boot directly to grub.