When loading something with UEFI LoadImage, signature validation is performed. However, we verify the kernel by its hash already, and don't want to sign it. Hence, we have to load it on our own.
Alois Wohlschlager