How to make grubx64.efi for secure boot?

I want to make a bootable USB drive that will boot with Secure Boot enabled (preferably both 32-bit and 64-bit if possible).
I want to change the default grub.cfg path and also add some modules such as cpuid, regexp, loopback, read and probe (if possible).

I can compile a version of grubx64.efi, but it does not work using the bootx64.efi shim in Secure Boot mode.
How can I 'sign' my grubx64.efi file so it boots with Secure Boot enabled like the current version?
I see grub-mkimage accepts a -pubkey parameter - do I need a .key file and how do I get one?
There is also a sbsign command - do I need to use this?
I have searched for days and cannot find any clue on how to do this?