What is the difference of having to use a ca.crt to verify a signed file vs the .crt used to sign it?

Question

This seemed like the most appropriate place to ask this question so here it goes:

I used to run a process that automatically generated a shim.key and shim.crt along with a ca.crt for safe boot signing. Using the shim versions I signd a file like this:

sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign

to verify the file I used the ca.crt file like this:

sbverify --cert path/to/ca.crt filetosign.signed

All worked okay. But trying to verify using shim.crt, as shown below, would would fail:

sbverify --cert path/to/shim.crt filetosign.signed

The updated process no longer generates the shim.key, shim.crt or ca.crt files automatically, I have to provide it the shim.crt. Looking at the script file I created last year, it appears that I first tried using efikeygen but it must not have worked because it's commented out; I don't recall what the problem was and there are no notes in the script. Instead I set it up to create the new shim.key and shim.crt file using openssl:

openssl req -newkey rsa:2048 -x509 -sha256 -days 3650 -nodes -out shim.crt -keyout shim.key -subj "/CN=Acme UEFI SB 2020/O=Acme Inc/L=New York/ST=New York/C=US" 
openssl pkcs12 -export -out shim.pfx -inkey shim.key -in shim.crt 
openssl x509 -outform der -in shim.crt -out shim.cer

That gave me a shim.key and shim.crt file, but no ca.crt file.

I can successfully sign and verify a file as follows:

sbsign --key path/to/shim.key --cert path/to/shim.crt filetosign
sbverify --cert path/to/shim.crt filetosign.signed

It gets confusing with all the different formats and terms used.

So a couple of questions:

1. Why would the original method, that created a ca.crt, not verify using the shim.crt, but the new one without the ca.crt did?

2. How could I create a shim.key, shim.crt and ca.crt that would work like it originally did?

TIA!!