Enable kernel module signing

Required for doing secure boot properly, defaults to permissive mode so doesn't hurt otherwise.