Comment by iam-TJ

"refused to load whatever distro I tried from SSD" sounds very much like a feature in AMI InsydeH2O firmware (and possibly others) where-by one has to manually "trust" the boot-loader file the boot menu entry points to. This doesn't seem to apply to Microsoft Windows boot loaders so I've always assumed the signing certificate is checked directly against the MS UEFI CA root rather than the intermediate 3rd party certificate that is used by Microsoft to sign distro shim files.

I have kept a screenshot of the firmware setup for years to remind me where the option can be found; looking at it now:

menu: Security > "Select UEFI file as trusted"

That would bring up a file-chooser where one can navigate the files in the EFI System Partition and select the distro's initial boot-loader file. For example, for a Debian install it would either or both of:

/EFI/debian/shimx64.efi /EFI/debian/grubx64.efi