Comment # 1 on bug 1195118 from Takashi Iwai

As default, the kernel contains only its static built (SLE) cert and the ones
passed from GRUB shim, and the error implies that the cert corresponding to
your KMPs aren't included there.

There are different builds of KMPs, a few of them are built with SLE, hence
they work as-is.  Others built from other OBS projects, including the official
openSUSE:Leap:*, they won't work unless you install the corresponding cert on
your system and enroll it via MOK manually.

There is a brief description in the release notes.  For Leap official KMPs,
install openSUSE-signkey-cert package, if you didn't install it yet, reboot and
enroll it at GRUB.  Note that the trigger happens only once after installing
this package.  You can uninstall it, reboot, and re-install it, and reboot.