When meta-secure-core is involved, and DISTRO_FEATURES efi-secure-boot and ima is enabled,
in meta-signing-key/classes/user-key-store.bbclass, it will add DEPENDS as following:
DEPENDS:append:class-target = " \
${@bb.utils.contains("DISTRO_FEATURES", "efi-secure-boot", "sbsigntool-native", "", d)} \
${@bb.utils.contains("DISTRO_FEATURES", "efi-secure-boot", "libsign-native", "", d)} \
openssl-native \
${@bb.utils.contains("DISTRO_FEATURES", "efi-secure-boot", "efitools-native gnupg-native", "", d)} \
"
I will talk to upstream about this first.