Ventoy uses https://github.com/ValdikSS/Super-UEFIinSecureBoot-Disk to boot unsigned ISOs on SecureBoot-Devices.
I haven't researched how to make it work with my own key - so I'm careful to delete the key afterwards or to not use the feature at all.
Using a grub2-solution like glim is sufficient for 99% of my use-cases, so I'm switching away from ventoy.
Making wimboot work with glim seems to be possible but experimental.. fortunately I don't need it.