This is a manual to convert a Debian installation to use EFI Stub for booting instead of relying on a conventional bootloader like GRUB. When used in conjunction with a unified kernel image, it is easy to sign kernel images and encrypt everything except the EFI boot partition while Secure Boot takes care of checking the kernel signature.
Installation is easier on a minimal system as less things can break. Note that this manual is intended for a fresh installation and not for converting your system, although that should be possible the same way. To make things easy, install your system as if you were going to use it normally.