I think it is preferable to use $image so changes to image name does not cause regression in signing. However, we should select explicitly which archs we want to sign as well. Signing ppc64 or s390x might break boot on some systems.