Thanks - I’m going to have to do a bit more reading to get my head around that. Secure Boot is not my forte!
I think I’ve found one of your previous posts with the links you were referring to: https://fedia.io/m/[email protected]/t/113434/UEFI-Secure-Boot-keys-replacement-guide-please-help-sanity-check
And also some more comments here that looked useful: https://lemmy.world/comment/11384715
I’ve stumbled across a solution: install the Linux Surface project kernel.
I’ve tested both the mainline kernel provided by Debian and the Linux Surface project and the former consistently produces the error with the keyboard detached. With the Linux Surface kernel it boots successfully regardless. I don’t fully understand the mechanism, unfortunately, but this provides a workaround at least.