I removed the pointer to the ckt/unstable ppa and purged all of the 4.18 kernels. I then installed the latest 4.17 kernel from -updates. That kernel, 4.17.0-9.10 now boots just fine with secure boot enabled. It looks like I did have more kernels installed from the ckt ppas than I thought I had.
I removed the pointer to the ckt/unstable ppa and purged all of the 4.18 kernels. I then installed the latest 4.17 kernel from -updates. That kernel, 4.17.0-9.10 now boots just fine with secure boot enabled. It looks like I did have more kernels installed from the ckt ppas than I thought I had.