Shim: System is compromised when using certificate, but not with hash

I am trying to boot a Linux kernel with efi stub enabled using Red Hat’s Shim https://github.com/rhboot/shim.