Comment by chuzz

That does not sound reasonable, why would the shim ever need to be signed with the same key? why can't a system supporting App Archive make an exception for the shim? if it can't for hardware reason, why can't they ask key owner to sign the shim app? That would degrade security but is not as bad as requiring to give away the private key.