and it means that there's a manual step regardless for those projects since we don't have access to the privkey to sign with so a new key would need to be manually imported by users
actually, the secure boot signing key (AND our cosign key) is an org global secrets, so we could use it in main if the choice was made to sign the whole kernel there, but i'm not yet convinced we should do so, even if it is the right choice for bluefin