Indeed, that is what the parent is referring to when they say this: > Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI)

Indeed, that is what the parent is referring to when they say this: > Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense (It's much more useful to have a link to it, so thank you!)