Sorry for delay.
Install sbsigntool
Create Certificate:
openssl x509 -outform der -in cacert.pem -out certificate.crt
The resulting certificate.crt is what will be used to verify the signature of the EFI binary. You will import this into the motherboards firmware database.
Sign EFI Binary:
sbsign --key cakey.pem --cert cacert.pem bootx64.efi --output BOOTX64.efi
After you sign the boot file, reboot into the firmware and import the certificate. Reboot normally and secure boot should work without issue.
iCloud or local Mac backup is the same in terms of data. A local Mac backup is significantly faster.