Docs do not mention SecureBoot blocks zfs kernel module

[upst-io]

While following Debian Bookworm Root on ZFS the setup of zfs-dkms fails to load the kernel module after the build step, printing:

insmod /lib/modules/6.1.0-15-amd64/updates/dkms/spl.ko                                                                           
modprobe: ERROR: could not insert 'zfs': Key was rejected by service

A user installing Debian Bookworm Root on ZFS may not notice this, and only come to a halt at the first zpool create which returns with:

The ZFS modules are not loaded.                                                                                                  
Try running '/sbin/modprobe zfs' as root to load them.

Of course, attempting /sbin/modprobe zfs comes back with the same:

modprobe: ERROR: could not insert 'zfs': Key was rejected by service

The solution to this was to change the SecureBoot setting in the BIOS from Deployed Mode to Audit Mode . This should be presented as a warning and instruction at the start of the procedure, to avoid having to reboot and setup the install environment again.