I'm trying to figure out the order of operations here for a custom kernel. I have no doubt vendor supported Linux (Redhat, Ubuntu, etc...) will be able to work

I'm trying to figure out the order of operations here for a custom kernel. I have no doubt vendor supported Linux (Redhat, Ubuntu, etc...) will be able to work around this. But what will the steps be for a custom kernel? It seems to be something like this: 1) Build kernel 2) Generate key 3) Sign kernel with key 4) Install key in UEFI key manager But the question I have is, what do we do with the key now? Is it kept on disk? If so, does that open up a new vector for attack? A Linux virus/worm that finds the signing key, generates a new hacked kernel, signs it, and then installs itself? I know that's a lot of steps, but then again, if a malevolent program gains root on a box, you can't really trust anything on it anymore. So I guess there isn't really anything too different about this approach, except that it may give you a false sense of security. I'd hope that there could be some warning about booting a new kernel. Maybe something like "You are booting a new operating system 'OSName v3.1.021b' with fingerprint: AB AD C0 DE AA ..., do you wish to continue? Yes / No / Always: _ "