win32-loader installs the Linux kernel and initial ramdisk file in the
win32-loader folder of the system drive.

The inclusion of the ntfs and ntfscomp modules into the
grub-efi-amd64-signed package would allow grub to access the
win32-loader folder residing on a NTFS partition even under a secure
boot regime.

See also:
https://bugs.debian.org/918863
https://salsa.debian.org/snippets/270

If http would be available in the grub-efi-amd64-signed package then
something like the following might bring the Debian Installer to life:

net_bootp efinet0
set root=(http,deb.debian.org)
linux

/debian/dists/testing/main/installer-amd64/current/images/netboot/debian-installer/amd64/linux
  priority=low vga=788 ---
initrd

/debian/dists/testing/main/installer-amd64/current/images/netboot/debian-installer/amd64/initrd.gz
boot

This approach uses the public http server of Debian and running your own
server for example in the case of using the tftp network protocol could
be eliminated.