After several attempts, in all directions, neither the USB key nor the SSD boot worked with the signature provided by Zorin 18.1 Core (--> Lenovo, All in One).
Finally, I disabled Secure Boot, as there was no way to add an exception in the UEFI.
Zorin does not require secure boot at all the new certificates is mostly for windows dont really do much for linux having secure boot off is actually better overall for zorin.... 
The user is quite inexperienced in computer security, which bothers me a bit.
Is the BIOS up-to-date?
Honestly, I didn’t look...
The computer coming out of its box, I didn’t think about it.
I asked because a current BIOS Update should offer the new Scure Boot Keys, too.