Refkit must provide the necessary tools and documentation to users to enable bootloader (existing EFI combo app) signing.
The change got merged: https://github.com/intel/intel-iot-refkit/pull/131