For others who stumble on this thread like I did, there’s a better discussion at Rocky Linux 8.5 Secure Boot Error
There was a bug in the upstream shim code that asked UEFI to delete some keys. Most ignore it, but ESXi does not.
So, we are waiting for that fix to be released in the upstream repo and then to be incorporated into Rocky Linux.