Keyfile support was initially added under GPL-2.0+ license as part of core. It was moved to "libnm-core" in commit 59eb5312 ('keyfile: merge branch 'th/libnm-keyfile-bgo744699'').
"libnm-core" is statically linked with by core and "libnm". In the former case under terms of GPL-2.0+ (good) and in the latter case under terms of LGPL-2.1+ (bad).
In fact, to this day, "libnm" doesn't actually use the code. The linker will probably remove all the GPL-2.0+ symbols when compiled with gc-sections or LTO. Still, linking them together in the first place makes "libnm" only available under GPL code (despite the code not actually being used).
Instead, move the GPL code to a separate static library "shared/nm-keyfile/libnm-keyfile.la" and only link it to the part that actually uses the code (and which is GPL licensed too).
This fixes the license violation.
Eventually, it would be very useful to be able to expose keyfile handling via "libnm". However that is not straight forward due to the licensing conflict.