A possible workaround is to split the kmp from the open-vm-tools. pesign-repackages is pulled in by kernel-source and it's for kernel/kmp and EFI files, so a separate spec could work around the issue.