[vladvasiliu]

The page seems to have changed since I've set this up, but this is what I've followed: https://wiki.archlinux.org/title/Unified_Extensible_Firmware...

The advice around the keys and signing is pretty generic. What's arch specific are the various integrations with the package manager than handle automatic signing of the kernel image after an upgrade.

Lower on the page there's a section about signing MS's certificates, so you can dual-boot windows while using your own keys. I have that setup on my work laptop and it works fine.