Instead of the grub2-efi-x64 package I would probably say GRUB EFI builds. Since the modules are not in the package but buitl-in the grub2x64.efi binary.

Inserting modules is not allowed when booting with Secure Boot enabled.

The verify module that's built-in now will allow to verify the signature of the modules but this can only be used with Secure Boot disabled.

Sorry that I wasn't clear in my previous comment. What I meant is that modules can only be inserted (and so it's signature verified) with Secure Boot disabled since enabling Secure Boot won't allow loading modules.

But the verify module can be used not only to verify grub modules, but any file that's loaded from disk (config files, kernel and initramfs images, etc) so it could be used even with Secure Boot enabled (it's just that modules can't be loaded and verified).

so I think it should say something like "This change enables users to verify that all files read from disk are properly signed".

Merged manually.