In case it helps tracking down why the bug appears between -18 and -21, I found this in -19:
linux (4.4.0-19.35) xenial; urgency=low ... * linux: Enforce signed module loading when UEFI secure boot (LP: #1566221) - [Config] CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE=y
In case it helps tracking down why the bug appears between -18 and -21, I found this in -19:
linux (4.4.0-19.35) xenial; urgency=low EFI_SECURE_ BOOT_SIG_ ENFORCE= y
...
* linux: Enforce signed module loading when UEFI secure boot (LP: #1566221)
- [Config] CONFIG_