https://wiki.archlinux.org/title/Unified_kernel_image#Prepar...
> Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense
(It's much more useful to have a link to it, so thank you!)
https://wiki.archlinux.org/title/Unified_kernel_image#Prepar...