Also, we use EFI signing, not gpg signing for kernels, and hence cannot make any guarantees about non-EFI-signed binaries.
Also, we use EFI signing, not gpg signing for kernels, and hence cannot make any guarantees about non-EFI-signed binaries.