UEFI secure boot kernel restrictions

I too find it weird, is there something going on behind the scenes that I'm not aware of that would make sense? As far as I can see our obligations for microsoft end at the shim, making sure it can't transparently load unsigned or modified code and interjected into the boot process by malware. As far as I can see that obligation has been met so there is nothing more to discuss with Microsoft.