Comment 13 for bug 1658255

Kees - there are archive shenanigans involved in getting a signed kernel binary, hence the separate package.

Steve - I'm not sure about the rationale for grub booting unsigned kernels. The foundations team might be able to explain it.