/usr/share/grub/grub-check-signatures is shipped by grub-common and the code is called when on_secure_boot is true. So grub-common should depend on mokutil.
/usr/share/ grub/grub- check-signature s is shipped by grub-common and the code is called when on_secure_boot is true. So grub-common should depend on mokutil.