Now I played with pesign-obs-integration and this approach looks more promising. Below is a patch to pesign-obs-integration package. This enables the compression at the repackaging phase after signing, so we can avoid the compress/decompress pingpong. The package in OBS home:tiwai:test:compress2 contains the patched pesign-obs-integration and kernel packages, as well as the patched dracut.