Comment # 12 on bug 1123245 from Neil Rickert

>That would be Boot0002* judging by the order, Boot0000* is the default boot.

Those two boot entries look identical to me.  However Boot0001 looks different
(using a different EFI partition).

Normally, an entry for secure-boot uses "shim.efi" rather than "grubx64.efi". 
And I do not see such an entry.

Can you provide the output from:

ls -l /dev/disk/by-partuuid/64f81fb7-f76b-4029-93d1-f975379ae4c7

That should identify the EFI partition used for Boot0001.

And can you also provide the output for:

ls -l /boot/efi/EFI/opensuse/grubx64.efi
ls -l /boot/grub2/x86_64-efi/core.efi

>What I still don't understand is why Leap had no problems

There was no reason for it to have problems.  You were using the "grubx64.efi"
installed by Leap 42.3, and it was using the "/boot/grub2/x86_64-efi/" also
installed by Leap.

Right now it looks as if you are still using the "grubx64.efi" installed by
Leap, but you are using "/boot/grub2/x86_64-efi/" installed by Tumbleweed.  And
there's a mismatch.