Comment # 3 on bug 1174860 from Gary Ching-Pang Lin

That's strange. openSUSE CA in shim is supposed to be able to verify the
rotated sign key.