GRUB fails to trust built-in public key

[lolock]

Hello everyone

I am trying to set up Secure boot on my Gentoo machine. I use 
grub-mkstandalone to generate an image that is signed by a firmware key. 
I then expect GRUB to verify my kernel with its detached signature, 
using a public key I embedded with the --pubkey option. If and only if 
the signature matches, the system should boot.

GRUB does successfully start and show the menu entries. If I select one, 
it fails with the error "error: public key b625168013908c5d not found." 
If I enter the GRUB shell, list_trusted returns nothing. The variable 
check_signatures is not automatically set to "enforce", despite the fact 
I used the --pubkey option. If I load the key manually with  --skip-sig, 
I can successfully verify the kernel and boot the system in Secure boot 
mode with verify_detached.

So, the problem is that GRUB does not add the key I provided with 
--pubkey to its trust store. However, the key is actually there in the 
EFI image, as I checked with a hexdump of the image and the key.

The exact command:

grub-mkstandalone --pubkey /boot/grub/grub.pub --verbose --directory 
/usr/lib/grub/x86_64-efi/ --format x86_64-efi --modules part_gpt fat 
ext2 configfile gcry_sha512 gcry_dsa gcry_sha256 gcry_rsa 
password_pbkdf2 echo normal linux linuxefi all_video search 
search_fs_uuid reboot sleep loadenv minicmd test echo font 
--disable-shim-lock --output /boot/EFI/gentoo/grubx64.efi 
/boot/grub/grub.cfg=/etc/default/grub-initial.cfg 
/boot/grub/grub.cfg.sig=/etc/default/grub-initial.cfg.sig

If I enable some debug flags, this is the output:

grub> verify_detached /vmlinuz-5.15.26-gentoo-x86_64 
/vmlinuz-5.15.26-gentoo-x86_64.sig
kern/verifiers.c:212: string: verify_detached 
/vmlinuz-5.15.26-gentoo-x86_64 /vmlinuz-5.15.26-gentoo-x86_64.sig, type 2
commands/pgp.c:823: alive
commands/pgp.c:828: alive
kern/verifiers.c:88: file:  /vmlinuz-5.15.26-gentoo-x86_64  type: 59
kern/verifiers.c:88: file:  /vmlinuz-5.15.26-gentoo-x86_64.sig type: 131102
kern/verifiers.c:88: file: (memdisk)/boot/grub/x86_64-efi/gcry_sha1.mod 
type: 1
commands/pgp.c:496: alive
commands/pgp.c:593: alive
commands/pgp.c:602: @ 34
commands/pgp.c:608: alive
commands/pgp.c:611: alive
commands/pgp.c:613: l = 0x0c00
commands/pgp.c:616: alive
commands/pgp.c:619: alive
commands/pgp.c:621: alive
commands/pgp.c:626: alive
error: public key b625168013908c5d not found.

I have posted this problem with some more detail on 
https://forums.gentoo.org/viewtopic-t-1147754-highlight-.html

What Am I doing wrong?

Any help is greatly appreciated, thanks in advance.

Greetings,

lolock