How do I enroll tumbleweed kernel signature in shim.efi?

I am running 64 bit tumbleweed and I would like to add the secure kernel signature to shim.efi so I can use secure boot.
I have tried following the instructions at: https://en.opensuse.org/openSUSE:UEFI
I have tried using both mokutil and MokManager.efi but it seems as if neither one has added the signature to MOK.

I am running lvm on luks with all partions but boot, boot/efi and swap formatted as btrfs.

Please do not suggest I turn off secure boot, I would not be asking this question if I wanted to run without secure boot enabled.

Thank you