The default for images is signed, not encrypted. A new section of self-modifying or encrypted kernel code would probably trigger some red flags.