Indeed, that is what the parent is referring to when they say this:

> Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense

(It's much more useful to have a link to it, so thank you!)