I found that PTF key is also signed by SLE CA, so the "ignore-ca-check" patch would ignore PTF key and make PTF kmp unloadable :(