Michal Suchanek just wrote in the email thread on factory ML --- Shouldn't this be set: config/x86_64/default:# CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY is not set The MOK keys get added to th secondary keyring, not primary. --- Could this be the issue here?