Hello,

I prepared this report and patch with AI assistance.
Debian testing's dkms 3.2.2-1 installs modules unsigned when openssl is absent, although autoinstall reports success.
The package declares openssl in no dependency field.
This prevents those modules from loading on systems that enforce module signatures.

I reproduced this in a clean Debian testing amd64 container with v4l2loopback-dkms 0.15.4-2 and linux-headers-amd64 7.2.12-1, targeting 7.2.12+deb14-amd64.
As root, with openssl initially absent:

    apt-get update
    apt-get -y --no-install-recommends install dkms v4l2loopback-dkms gcc python3 xz-utils
    apt-get -y --no-install-recommends install linux-headers-amd64

Both installs exit 0 and openssl remains absent.
The headers installation prints:

    openssl not found, can't generate key and certificate.
    Autoinstall on 7.2.12+deb14-amd64 succeeded for module(s) v4l2loopback.

For /lib/modules/7.2.12+deb14-amd64/updates/dkms/v4l2loopback.ko, modinfo -F signer prints an empty line and the file has no module signature trailer.

I enabled deb-src for testing, ran apt-get source dkms=3.2.2-1 and apt-get -y --no-install-recommends build-dep dkms=3.2.2-1, applied the patch below and built with dpkg-buildpackage -b -us -uc -j4.
The build exited 0 and openssl was still absent.
I kept the version unchanged for this local test, so the only source change is the added dependency.
In the same container, installing the resulting package with apt-get -y --allow-downgrades --no-install-recommends install --reinstall ./dkms_3.2.2-1_all.deb automatically installed openssl 3.6.5-1 and removed nothing.
APT required --allow-downgrades for this different local archive with the same version.
dkms was the only installed package with a direct Depends on openssl, and openssl was marked automatically installed.

The old unsigned module remains unchanged until rebuilt:

    dkms build --force v4l2loopback/0.15.4 -k 7.2.12+deb14-amd64
    dkms install --force v4l2loopback/0.15.4 -k 7.2.12+deb14-amd64

Both commands exit 0.
The installed module now has signer "DKMS module signing key", and its sig_key matches the serial of /var/lib/dkms/mok.pub.
The extracted PKCS#7 signature verifies against that certificate with openssl cms -verify -binary -nointern -noverify, returning 0 and "CMS Verification successful".
Changing one byte of the signed content or substituting an unrelated certificate makes verification return 4.
This verifies the module signature, not certificate enrollment or a Secure Boot boot; no module was loaded in this container.
The kernel in reportbug's system information is the shared host kernel, not the Debian module target above.

Please add openssl to Depends so the default signing path also works when installing without recommendations.
Debian Policy 7.2 bases dependency strength on the importance of the component; module signing is needed for usable modules when signature enforcement is enabled.
https://www.debian.org/doc/debian-policy/ch-relationships.html#binary-dependencies-depends-recommends-suggests-enhances-pre-depends

The patch against Debian's dkms 3.2.2-1 is:
--- a/debian/control
+++ b/debian/control
@@ -22,6 +22,7 @@
  dpkg-dev,
  make | build-essential,
  patch,
+ openssl,
 Recommends:
  gcc | c-compiler,
  fakeroot,