per $4:
grub-efi-amd64-signed's postinst will execute /usr/share/grub/grub-check-signatures when Secure Boot is on, and then it will execute mokutil no matter there is any DKMS or not.
per $4:
grub-efi- amd64-signed' s postinst will execute /usr/share/ grub/grub- check-signature s when Secure Boot is on, and then it will execute mokutil no matter there is any DKMS or not.