xenial still needs an SRU to drop the previous setup_mok_validation code (but not add update-secureboot-policy).
xenial still needs an SRU to drop the previous setup_mok_ validation code (but not add update- secureboot- policy) .