Comment 9 for bug 1920008

In bionic chroot, without proposed, installed grub-efi-amd64-signed

# dpkg-query -W | grep grub
grub-common 2.02-2ubuntu8.21
grub-efi-amd64 2.02-2ubuntu8.21
grub-efi-amd64-bin 2.02-2ubuntu8.21
grub-efi-amd64-signed 1.93.24+2.02-2ubuntu8.21
grub2-common 2.02-2ubuntu8.21

Enable -proposed, and try to install grub-efi-amd64-signed, alone (no full-upgrade)

# apt install grub-efi-amd64-signed
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages were automatically installed and are no longer required:
  gnupg-agent libssl1.0.0 multiarch-support
Use 'apt autoremove' to remove them.
The following additional packages will be installed:
  grub-common grub-efi-amd64 grub-efi-amd64-bin grub2-common
Suggested packages:
  multiboot-doc grub-emu xorriso desktop-base console-setup
The following packages will be upgraded:
  grub-common grub-efi-amd64 grub-efi-amd64-bin grub-efi-amd64-signed grub2-common
5 upgraded, 0 newly installed, 0 to remove and 110 not upgraded.
Need to get 3561 kB of archives.
After this operation, 6137 kB of additional disk space will be used.
Do you want to continue?

Horay, grub2-common is being upgraded.

$ grub-mkimage -O x86_64-efi -o foo -p /boot/grub --verbose
...
lots of text

The image is successfully created.