/usr/bin/sign-efi-sig-list

Usage: /usr/bin/sign-efi-sig-list [-r] [-m] [-a] [-g <guid>] [-o] [-t <timestamp>] [-i <infile>] [-c <crt file>] [-k <key file>] [-e <engine>] <var> <efi sig list file> <output file>
Produce an output file with an authentication header for direct
update to a secure variable.  This output may be signed by the usual keys directly
or may be split for external signing using the -o and -i options.

Options:
	-r               the certificate is rsa2048 rather than x509 [UNIMPLEMENTED]
	-m               Use a monotonic count instead of a timestamp [UNIMPLEMENTED]
	-a               Prepare the variable for APPEND_WRITE rather than replacement
	-o               Do not sign, but output a file of the exact bundle to be signed
	-t <timestamp>   Use <timestamp> as the timestamp of the timed variable update
	                 If not present, then the timestamp will be taken from system
	                 time.  Note you must use this option when doing detached
	                 signing otherwise the signature will be incorrect because
	                 of timestamp mismatches.
	-i <infile>        take a detached signature (in PEM format) of the bundle
	                 produced by -o and complete the creation of the update
	-g <guid>        Use <guid> as the signature owner GUID
	-c <crt>         <crt> is the file containing the signing certificate in PEM format
	-k <key>         <key> is the file containing the key for <crt> in PEM format
	-e <engine>      Use openssl engine <engine> for the private key