It turns out, everything is already in place to enable kernel module signing. All that's necessary is to provide a certificate and private key at the correct path; if those are present, the modules files will be signed during `modules_install`.
