The Linux Foundation's UEFI secure boot system

It's not implemented that way - basically on BIOS you call a card's UNDI driver and it implements PXE. On UEFI, the card's option ROM implements a native UEFI driver, and PXE, protocol-wise, is handled by the system's firmware. The option ROM is *also* a signed binary or it won't be loaded.

So the firmware downloads shim.efi from the server, and then it does whatever steps it needs to after that using UEFI APIs.