To reproduce:
scripts/tar-up.sh
scripts/osc_wrapper build --clean kernel-source/kernel-default.spec
or that + --alternative-project=Kernel:SLE15-SP3

result:
...
[ 1717s] Signing certificates
[ 1717s] + certs=()
[ 1717s] + test y = y
[ 1717s] + for f in /home/abuild/rpmbuild/SOURCES/.kernel_signing_certs/*.crt
[ 1717s] + mkdir -p
/home/abuild/rpmbuild/BUILDROOT/kernel-default-5.3.18-0.g316993b.x86_64/etc/uefi/certs
[ 1717s] + cp -v '/home/abuild/rpmbuild/SOURCES/.kernel_signing_certs/*.crt'
/home/abuild/rpmbuild/BUILDROOT/kernel-default-5.3.18-0.g316993b.x86_64/etc/uefi/certs
[ 1717s] cp: cannot stat
'/home/abuild/rpmbuild/SOURCES/.kernel_signing_certs/*.crt': No such file or
directory
[ 1717s] error: Bad exit status from /var/tmp/rpm-tmp.Qthsdz (%install)

Reverting the rpm/kernel-binary.spec.in bits fixes it up for me, but that's
clearly not a proper solution.  Do external builders have to pass another arg
to osc_wrapper or do some .oscrc configuration changes after that commit?

Note: I'm running Leap-15.3, I'm filing this bug against it because SLE15-SP3
is its kernel (shrug).  What I want to build is actually my local SLE15-SP3-RT,
which precedes the export of the SUSE SLE15-SP3-RT branch by a lot, and which I
of course consider superior, me being its 'mom' ;-)