There's a closed pull request on the void-packages repository

sbsigntool: rewrite post-install kernel hook
https://github.com/void-linux/void-packages/pull/23688

Description:
* run the hook on target filesystem
* Use ls | awk to check ownership and permission, instead of relying on
  GNU-stat.
* libify signing code, in order to support uefi bundle in the future
* Stop append signature to the efi signed by current key/cert.

While we're at it,
* add post-remove script to remove unsigned file if exist

---

@ericonr @ahesford I think you may be interested on this.