I don't know if you're being sincere or just trying to gotcha it, but Ubuntu has had support for this for ages as part of DKMS [0]. It generates a key and registers it with the firmware during setup if secure boot is on, and it signs any modules you build with that key as part of the regular DKMS build.

[0] https://wiki.ubuntu.com/UEFI/SecureBoot#MOK_generation_and_s...