To reproduce the problem, make sure you have a GPG public key available, build and install GRUB:
grub-install --debug --debug-image="all" --pubkey=/boot/pubkey.gpg --modules="serial terminfo gzio search search_label search_fs_uuid search_fs_file linux vbe video_fb video mmap relocator verify gcry_rsa gcry_dsa gcry_sha256 hashsum gcry_sha1 mpi echo loadenv boottime" /dev/sda
Sign all the files in /boot/grub/* and reboot.
'make check' results identical before and after this change.
TESTED: In a QEMU VM using an i386 target.
[v0] Accepted with modifications by phcoder@
[v1] Introduce subsections within Security
[v1] Correct errors regarding public key files not being automatically signature-checked in trust and verify_detached
[v1] Replace check_signatures=enforce with check_signatures set to enforce
[v1] Move detailed discussion of using signatures out of check_signatures environment variable description
[v1] Use long form for option flags to security-relevant commands
[v2] Explain the key fingerprint format for distrust and list_trusted.
[v2] Eliminates references to grub-mkimage and UEFI Secure Boot.
[v3] Updates in response to addition of --skip-sig to trust and verify_detached
[ ] Restore @xref for cross-references at the start of sentences
Jon McCune