Is it possible to delete an enrolled key using mokutil without the original .der file?

To delete only one specific key from the database you could first use the --export flag, like so:

$ mokutil --export

This will export all machine owner keys to the current directory:

$ ls -1 MOK*
MOK-0001.der
MOK-0002.der
...

They are numbered according to the list given by

$ mokutil --list-enrolled
[key 1]
SHA1 Fingerprint:....
...
[key 2]
SHA1 Fingerprint:....

which should then enable you to delete only one specific key, e.g. key 1:

# mokutil --delete MOK-0001.der

Figured it out. The --reset parameter does the trick.

sudo mokutil --reset

If you had multiple MOKs enrolled and only wanted to remove one it might not be ideal.

If someone comes up with a better option I'll accept that answer.