Microsoft requires NX support for signing since Nov 30.

shim 15.7 does not enable NX support, a patch is available here:

rhboot/shim#530

Alternative run post-process-pe manually with the right flag set.

Also NX support needs to be added to bootloader and kernel.

Hence please don't submit shims for review if you don't have working NX stack or at least prepped the shim for NX (I mean you can continue working on the rest in the meantime).