sbctl 0.12 wants to have the forbidden signatures or fails to enroll keys.
To clean up the repository move the uefi keys (`pki/`) to `nix/tests/fixtures/uefi-keys`.