Comment # 13 on bug 1209006 from Stefan Dirsch

For me this looks like we are't prepared at all for supporting 3rd party kernel
modules signed with their own MOK certificates with this kernel update with
lockdown patches enabled.

So I suggest to revert this and work on how to support this for a later kernel
update with lockdown patches re-enabled.