mokutil is technically the wrong tool for this, it lists shim-installed machine owner keys (MOK). This is about UEFI-installed key exchange keys (KEK). If you don't know what's going on you'll be very confused about empty key lists. It can in fact show KEKs but you need to know that this is a KEK thing to begin with…

  mokutil --kek | egrep '(Not |Subject:|^[^ ])'

is the magic incantation if you really want to use mokutil