On Wed, 24 Mar 2021 14:58:05 +0200, you said:

> What kind of changes in the kernel require testing with valid signatures ?

Pretty much only changes that affect module signing.

If your threat model doesn't include "hacker sticks rogue module on
your box and gets it loaded to install backdoor", you can turn off
module signing on your self-compiled kernels.  Distros don't do that,
because those kernels *do* get installed on high-value targets where
"hacker installs backdoor kernel module" is very much part of the threat model.

Conversely, you can get secure boot to work with self-compiled kernels, but you
have to create a local trusted signature, feed it to the bios/efi, then sign
grub2 with that signature, and then lather/rinse repeat, telling grub2 about a
certificate used to sign the kernel, and then enable kernel module signing.
Very much a  "some assembly required" procedure, and you have to remember to
re-sign grub2 whenever it's updated.