Currently, neither nixpkgs.OVMF.fd nor nixpkgs.OVMFFull.fd provide OVMF code and var files that work with secure boot.

The Debian ovmf package provides files OVMF_CODE_4M.secboot.fd and OVMF_VARS_4M.ms.fd that work correctly, so I know they are buildable from TianoCore's source.

Pinging OVMF maintainers @adamcstephens and @RaitoBezarius.