I don't know how to solve the locked UEFI, but there is Shim, a efi-stub which is signed and can be configured to validate your own keys. Here is the first documentation I found: https://wiki.gentoo.org/wiki/Shim.