securebootsign

Create new keys for secureboot

https://wiki.archlinux.org/index.php/Unified_Extensible_Firmware_Interface/Secure_Boot#Creating_keys

Create new combined signed EFI image

./signkernels.sh

Remount efivars writable

moutn -o remount,rw /sys/firmware/efi/efivars

Create boot entry

efibootmgr --create /dev/sda --part 1 --label ArchLinux_combined --loader EFILinuxvmlinuz-linux.efi --verbose

sign automatically after updates

cp 96-signkernels.hook /etc/pacman.d/hooks/