Comment # 2 on bug 1195118 from Giacomo Comes

The package openSUSE-signkey-cert is already installed however
  mokutil --test-key /etc/uefi/certs/BDD31A9E-kmp.crt
was telling that the key was not enrolled
After running:
  mokutil --import /etc/uefi/certs/BDD31A9E-kmp.crt --root-pw
I rebooted and enrolled the key. Now the modules can be imported.

I assume that openSUSE-signkey-cert was installed during the OS installation,
but when the machine rebooted, no one was in front of the console to enroll the
new key.

In my opinion this is a flaw of the openSUSE installation process.
Once the installation process completes, the machine reboots and if no one is
in front of the console the enroll process is missed and/or boot error messages
as well.
Fedora instead, after the installation process is completed, ask you to press a
reboot button before continuing. I this way there is a person in front of the
console when the machine reboots and he can take appropriate action if
required.