So based on @j4k3@lemmy.world's advice, I had a look at RHEL and found this:
https://github.com/rhboot/shim/ https://github.com/rhboot/shim/blob/main/SbatLevel_Variable.txt https://github.com/rhboot/shim/blob/main/SBAT.md#uefi-sbat-variable-content
Debian's own shim repo (https://salsa.debian.org/efi-team/shim) seems to derive from this. Shim is apparently the bootloader application that is reporting the error I'm seeing.
Unfortunately still no idea what causes the issue (let alone why it's correlated with the keyboard), but it makes me wonder if somehow the contents of the SbatLevel variable aren't formatted correctly in the absence of the keyboard cover.
More digging required.
Thanks - I'm going to have to do a bit more reading to get my head around that. Secure Boot is not my forte!
I think I've found one of your previous posts with the links you were referring to: https://fedia.io/m/linux@lemmy.world/t/113434/UEFI-Secure-Boot-keys-replacement-guide-please-help-sanity-check
And also some more comments here that looked useful: https://lemmy.world/comment/11384715