GRUB2 Multi-Linux Dual Boot (Secure Boot & shimx64.efi)

If I understand correctly, the shimx64.efi is what actually gets loaded by the UEFI BIOS. Does this file only contain the secure boot information for a single kernel?

Almost but not quite correct. A version of the shim is signed by Microsoft for each distribution, and the shim includes the Secure Boot public key of the distribution it belongs to. When the shim is used, it temporarily (non-persistently) adds the distribution's Secure Boot key to the list of keys allowed to boot the system. Optionally the shim can add a Machine Owner's Key (MOK) too.

So, when you load Fedora's shimx64.efi, it makes it possible for Secure Boot to accept things signed by Fedora. Then it loads grubx64.efi, which is signed by Fedora and now acceptable to the Secure Boot firmware. When grubx64.efi loads Fedora's kernel, the kernel file is signed by Fedora and so Secure Boot allows the kernel code to be executed.

If you wanted to build your custom kernel, you would have to create a MOK and sign your custom kernel with it. Also, if you wanted to build custom or third-party kernel modules, you would have to sign them with the MOK too, because one part of the Secure Boot "contract" is that no unsigned kernel code must be allowed. So the bootloader must check the kernel's signature, and the kernel must check the signature of each module when Secure Boot is enabled.

You won't be able to sign anything with the distribution's Secure Boot key, because that requires the private part of the distribution's Secure Boot key - which is presumably kept extremely safe by the people responsible for the security of the respective distribution.

And installing your MOK on other peoples' machines would be almost as bad as disabling their Secure Boot, as it would then enable you to boot anything on their systems.

Apparently chainloading another copy of shim after one shim is already loaded should work in theory, but the shim's source code comments indicate it's not exactly trivial.