Comment 48 for bug 2007743

An updated grub is available for testing in 22.10 (and other versions once everything has been published and builds retriggered) in the PPA:

ppa:ubuntu-uefi-team/ubuntu/ppa

This is not trusted by the default Ubuntu key!

To test, you need to import the PPA signing key

https://ppa.launchpadcontent.net/ubuntu-uefi-team/ppa/ubuntu/dists/kinetic/main/uefi/grub2-amd64/current/control/uefi.crt

You can convert it to DER format by running

openssl x509 -in uefi.crt -out uefi.der -outform der

and then importing it into the MOK using

mokutil --import uefi.der

Please make sure to only update grub-efi-amd64-signed and related packages from the PPA and not newer shims or similar changes, and remove the PPA immediately after, then remove the key after a new update has been published in the main archive.