Comment 3 for bug 1518018

Please run 'apport-collect 1518018' from the affected system.

The most likely explanation of this behavior is that the -signed packages (grub-efi-amd64-signed, shim-signed) have accidentally become uninstalled from your system, possibly due to a wrong apt sources configuration that pulled inconsistent packages from -proposed; this would leave you with only the unsigned packages installed, which the upgrade would then try to write as your bootloader despite being incompatible with SecureBoot.

It may be a good idea for us to check the presence of signed bootloaders + secureboot on upgrade and warn/fail if we are trying to install an unsigned bootloader; yours would not be the first report of boot problems resulting from uninstalling the secureboot bootloader package.