Perform MOK management after Ubuntu install: documentation?

Q4. How do I get the third party drivers installed properly if the MOK management screen no longer appears after boot?

The MOK management screen at boot appears only once after doing a change in the running system.
If you do not enroll the MOK key at the next boot, the key is discarded and you have to re-do the action from the beginning.

Documentation: https://wiki.ubuntu.com/UEFI/SecureBoot

Thank you Manfred!

Q5: Is there an alternative to reinstalling the system? Would it mean removing and re-adding packages with apt?

Q6: How do I identify which drivers might require enrolling a key?

for Q5:
The steps are somewhat independent.
With the mokutil command you can register a key that will be offered for enrolling at the next reboot. No new installation or re-adding packages necessary.
Signing the modules is separate. Either done with kmodsign, eventually fully automated.

For Q6: If you have secureboot with signature verification enabled, all kernel modules to be loaded require to be signed with a trusted key.
The modules delivered with the Ubuntu kernel are already signed, for everything else you have to manage signing yourself (with a MOK key that you have to register in your system).

Thank you;
does "modules delivered with the Ubuntu kernel" include all the drivers and firmware that the Ubuntu/Kubuntu install .iso will download when the "third party firmware" option is selected?

For example: nvidia drivers? touchpad? wifi? fingerprint reader?

Sorry, I do not know these details.

"... third party firmware ..."

Firmware is not loaded as kernel module, so it need not be signed.

The output of these two commands are different:

mokutil -l
openssl x509 -inform DER -in /var/lib/shim-signed/mok/MOK.der -noout -text

and more decisively:
# mokutil -t /var/lib/shim-signed/mok/MOK.der
/var/lib/shim-signed/mok/MOK.der is not enrolled

So perhaps I could use mokutil to enroll /var/lib/shim-signed/mok/MOK.der ?

I have read man mokutil and it is not obvious to me how to do it. Any idea?

Thank you Manfred! Content there states:

"Enrolling your key

$ sudo mokutil --import MOK.der # prompts for one-time password
$ sudo mokutil --list-new # recheck your key will be prompted on next boot

<rebooting machine then enters MOK manager EFI utility: enroll MOK, continue, confirm, enter password, reboot>

$ sudo dmesg | grep cert # verify your key is loaded"

This works!

SUMMARY OF QUESTIONS AND ANSWERS:

Q1. What do I do at this "Perform MOK management" screen?
When rebooting machine enters MOK manager EFI utility: enroll MOK, continue, confirm, enter

Q2. Is this documented anywhere?
https://wiki.debian.org/SecureBoot#Enrolling_your_key
https://wiki.ubuntu.com/UEFI/SecureBoot

Q3. After no response from me it auto-restarted several times and now skips MOK management going directly to a GRUB menu.
What do I need to do if I do NOT get the MOK management screen?

sudo mokutil -t /var/lib/shim-signed/mok/MOK.der # (Optional)
sudo mokutil --import /var/lib/shim-signed/mok/MOK.der
sudo mokutil -t /var/lib/shim-signed/mok/MOK.der # (Optional)
Then reboot and see answer to Q1.

Q4-6 are irrelevant now, I hope.
Thanks to Manfred Hampl !

Thanks Manfred Hampl, that solved my question.