There is an updated pull request by sgn against master on the void-packages repository

https://github.com/sgn/void-packages sbsigntool-rewrite-hook
https://github.com/void-linux/void-packages/pull/23688

sbsigntool: rewrite post-install kernel hook
* run the hook on target filesystem
* Use ls | awk to check ownership and permission, instead of relying on
  GNU-stat.
* libify signing code, in order to support uefi bundle in the future
* Stop append signature to the efi signed by current key/cert.

While we're at it,
* add post-remove script to remove unsigned file if exist

---

@ericonr @ahesford I think you may be interested on this.

A patch file from https://github.com/void-linux/void-packages/pull/23688.patch is attached