AFAICT from "rpm -q --scripts kernel-default" it looks like mokutil is called always and would retry importing the key each and every time as long as the user doesn't actually import it in mok.