Hacker News Reader

Yes. Debian ships with shim-signed which has been signed by Microsoft UEFI CA & will in turn boot grub-efi-amd64-signed which will then boot a signed kernel. So you have a chain of trust from a standard UEFI system to the kernel.

All of this is installed by default with a normal Debian install.

Yes, Debian comes with a signed bootloader and kernel.

> Do debian ships with a microsoft signed bootloader ?

Yes.