As you already discovered in the other comment, the root Secure Boot key is the PK, and the MOK is a concept that shim made up. shim was created so that people

As you already discovered in the other comment, the root Secure Boot key is the PK, and the MOK is a concept that shim made up. shim was created so that people didn't have to enroll their own PK, if their firmware even let them do that in the first place. Every distro that uses shim was able to get it signed by Microsoft (MS would not sign each and every bootloader in existence, and especially not any version of grub), and then shim does its own verification of the next stage application using the MOK DB.