iCloud or local Mac backup is the same in terms of data. A local Mac backup is significantly faster.

Sorry for delay.

Install sbsigntool

Create Certificate:

openssl x509 -outform der -in cacert.pem -out certificate.crt

The resulting certificate.crt is what will be used to verify the signature of the EFI binary. You will import this into the motherboards firmware database.

Sign EFI Binary:

sbsign --key cakey.pem --cert cacert.pem bootx64.efi --output BOOTX64.efi

After you sign the boot file, reboot into the firmware and import the certificate. Reboot normally and secure boot should work without issue.

If you are near a uBreakiFix (official repair partner for Google) stop by a store. The original device warranty does not matter. As long as your device is not severely damaged and the IMEI is flagged as eligible, the battery is covered under the extended warranty replacement. If the screen was damaged because the battery swelled, that's covered too.

Source: I work for ubreakifix. I have dealt with this all week.

Secure boot will fail validation. You can still boot it anyway by disabling secure boot. You just lose a layer of security. You can manually sign boot files yourself and add the relevant certificate to the motherboard firmware database. Assuming it lets you.