install on bionic/arm64 fails with "unsigned kernels" error

I booted a cloud image w/ SecureBoot disabled, upgraded it to the HWE kernel (required for SecureBoot - LTS kernel isn't signed), then rebooted and turned on SecureBoot. I then enabled proposed and tried to install the updated shim-signed. This brought in the new grub-efi-arm64-signed as a dependency, which is expected, but it failed to upgrade, which was unexpected:

Unpacking grub-efi-arm64-signed (1.187.3~18.04.1+2.06-2ubuntu14.1) over (1.173.2
~18.04.1+2.04-1ubuntu47.4) ...
Preparing to unpack .../grub-efi-arm64_2.06-2ubuntu14.1_arm64.deb ...
Package configuration

 ┌───────────────────────────┤ unsigned kernels ├────────────────────────────┐
 │ │
 │ Cannot upgrade Secure Boot enforcement policy due to unsigned kernels │
 │ │
 │ Your system has UEFI Secure Boot enabled in firmware, and the following │
 │ kernels present on your system are unsigned: │
 │ │
 │ 5.4.0-137-generic │
 │ │
 │ │
 │ These kernels cannot be verified under Secure Boot. To ensure your │
 │ system remains bootable, GRUB will not be upgraded on your disk until │
 │ these kernels are removed or replaced with signed kernels. │
 │ │
 │ <Ok> │
 │ │
 └───────────────────────────────────────────────────────────────────────────┘

E: Your kernels are not signed with a key known to your firmware. This system wi
ll fail to boot in a Secure Boot environment.
dpkg: error processing package grub-efi-arm64-signed (--configure):
 installed grub-efi-arm64-signed package post-installation script

That kernel *is* signed - I'm currently booted on it in SecureBoot mode.
ubuntu@ubuntu:~$ uname -a
Linux ubuntu 5.4.0-137-generic #154~18.04.1-Ubuntu SMP Tue Jan 10 16:58:27 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
ubuntu@ubuntu:~$ sudo mokutil --sb-state
SecureBoot enabled

Strangely, I did not see this when upgrading on focal, jammy, kinetic or lunar.