I thought that Rocky already has signed kernel. Post Install Enabling Secure Boot - #2 by brian
The Secure Boot is a feature in UEFI mode boot. The firmware, UEFI (aka BIOS), has some certificates stored on the motherboard. The Secure Boot checks bootloader, kernel, and kernel modules that they are all signed by some of the certificate chains that the UEFI has. If signatures are not valid, then invalid components are not loaded.
Therefore, Secure Boot does not prevent “other” OS, just unknown OS, and Rocky ought to be known.
Then again, an ancient machine might not have valid certificates for any current OS.
It is possible to load certificates to the UEFI (with mokutil).