@sgennadi Thanks for the write-up. It matches what I found. --addcert first appears in sbsigntools 0.9.4, so 0.9.4 is the minimum. EPEL 8 ships 0.9.2, so this affects every EL8 install, not only Oracle Linux. The Rocky Linux Core SIG package you used is a good way to get a newer version.
A dev-branch change (PR #2081) makes the installer test for --addcert before it signs. When the option is missing, the installer now names the required version instead of printing a bare “Failed”.