Comment # 9 on bug 1194184 from Takashi Iwai

(In reply to Ulrich Windl from comment #8)
> (In reply to Takashi Iwai from comment #7)
> > When you install openSUSE-signkey-cert package and reboot, GRUB will ask you
> > whether to enroll the new cert key or not. (...)
> 
> # LANG= zypper install openSUSE-signkey-cert
> Loading repository data...
> Reading installed packages...
> 'openSUSE-signkey-cert' is already installed.
> No update candidate for 'openSUSE-signkey-cert-20210302-lp153.1.1.x86_64'.
> The highest available version is already installed.
> Resolving package dependencies...
> Nothing to do.
> 
> So obviously this is not the solution.
> 
> The original upgrade had output this:
> (1211/5706) Installing: openSUSE-signkey-cert-20210302-lp153.1.1.x86_64
> .....[done]
> Additional rpm output:
> EFI variables are not supported on this system
> Failed to import /etc/uefi/certs/BDD31A9E-kmp.crt

Well, if your system doesn't support EFI variable, it's no way, and you really
don't have to care about those issues at all.

But you can retry and check again: uninstall openSUSE-signkey-cert package
once.  Then install it again, check whether the error persists.  Then reboot
and check whether you can enroll it.