Comment # 8 on bug 1194184 from Ulrich Windl

(In reply to Takashi Iwai from comment #7)
> When you install openSUSE-signkey-cert package and reboot, GRUB will ask you
> whether to enroll the new cert key or not. (...)

# LANG= zypper install openSUSE-signkey-cert
Loading repository data...
Reading installed packages...
'openSUSE-signkey-cert' is already installed.
No update candidate for 'openSUSE-signkey-cert-20210302-lp153.1.1.x86_64'. The
highest available version is already installed.
Resolving package dependencies...
Nothing to do.

So obviously this is not the solution.

The original upgrade had output this:
(1211/5706) Installing: openSUSE-signkey-cert-20210302-lp153.1.1.x86_64
.....[done]
Additional rpm output:
EFI variables are not supported on this system
Failed to import /etc/uefi/certs/BDD31A9E-kmp.crt

(From comment #3)
> AFAIK I'm not using Secure Boot, so does that apply?

I'm booting from MBR with no EFI partition involved.