Comment 7 for bug 1827697

ok based on the process tree I've identified the source of the trouble, /etc/kernel/header_postinst.d/dkms invokes dkms_autoinstaller with >/dev/null. So this is a similar symptom to other bugs that have been fixed, but is a separate unfixed bug.

Note that a workaround for this problem is to run 'sudo update-secureboot-policy --enroll-key' outside of apt.