On Fri, 12 Mar 2021 09:01:36 +0000, David Howells said:

> Possibly I can add something like:
>
> 	clean-files := signing_key.pem x509.genkey
>
> inside the
>
> 	ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
> 	...
> 	endif

Would that remove them on a 'make clean', or only a 'make mrproper'?
The latter sounds like the correct solution to me, as the signing key should
have (roughly) the same lifetime rules as the .config file.