(In reply to Marcus Meissner from comment #1) > we usually use pesign fwiw. Thanks for your feedback Marcus. This issue was spotted by dracut upstream (https://github.com/dracutdevs/dracut/issues/2197), as it uses sbsign to sign UEFI images. Do you suggest to use pesign instead?