actually, the secure boot signing key (AND our cosign key) is an org global secrets, so we could use
actually, the secure boot signing key (AND our cosign key) is an org global secrets, so we could use it in main if the choice was made to sign the whole kernel there, but i'm not yet convinced we should do so, even if it is the right choice for bluefin
