One possible solution would be to make mokutil read keys from kernel keyring, so it can avoid enrolling the key built in kernel. Have to do some research on the kernel keyring.