Hello i'm doing the ultimate necroposting, you can do secure boot through sbctl as stated in the archwiki, make sure to run
sudo grub-install --target=x86_64-efi --efi-directory=esp --bootloader-id=GRUB --modules="tpm" --disable-shim-lock
and
sudo grub-mkconfig -o /boot/grub/grub.cfg
or else it will fail to boot
also when you verify, vmlinuz-linux may not show up, so u gotta sign it manually:
sudo sbctl sign -s /boot/vmlinuz-linux