Made some headway and got UEFI working easily. @Patrick please decide if we want this as a default feature and if so, please see the referenced link below and choose the appropriate mode depending on whether you want to restrict unsigned boot or not and if you see value in storing the keys in the TPM in our threat model. Perhaps this discussion can be moved to its own thread. For TPMv2 activation purposes, the following has successfully been used to make it appear in the VM.
<os firmware='efi'>
<firmware>
<feature enabled='yes' name='secure-boot'/>
<feature enabled='yes' name='enrolled-keys'/>
</firmware>
</os>