[Xperia Z5 Compact General] gspbeetle:
Ok, here is a more complete step to step instructions for updating only to Android 7, currently also updated to 32.4.A.0.160 (7.1.1).

There actually are some other methods to do this now, but since we are already in this thead I would just use smartphone-tester's method.

1. Unlock the bootloader, if it is not already opened for some reason.

To verify, dial *#*#7378423#*#* -> Service info -> Configuration

2. Uninstall all non-systemless modules (especially xposed) before flashing, Xposed currently still does NOT work with Andriod 7

There is no need to remove SuperSU at all.

Downloading required files

3. Download the latest flashtool (+xpera firm) here

4. Download the latest root kernel (+flash_dk) here

5. Download the latest SU zip here

6. Download the latest Ext2Read here

7. Open flashtool -> xperia firm (XF logo)

8. Download the latest firmware (by default, it goes to %USERPROFILE%\.flashTool\firmwares)

Extract the kernel

9. Flashtool -> Tools -> SIN Editor to extract the kernel from kernel_*.sin in the directory created by XperiFirm --> kernel.elf file

10. Move the kernel.elf to the folder where rootkernel*.zip was extracted to

Prepare TWRP recovery (Credits to sceryavuz's instructions)

Do this if rootkernel says "No kernel modules for 3.10.84-perf-g99119bc" (or whatever other name it says)

11. Flashtool -> Tools -> SIN Editor to extract data from system_*.sin

12. Use Ext2Read to open system.ext4 file

13. Save this folder into your desktop "/lib/modules"

14. Create a folder named 3.10.84-perf-g99119bc (or whatever name it says missing) into rootkernel*\Android\twrp_common_kmodules

15. Copy required files into this folder

core_ctl.ko
ecryptfs.ko
kscl.ko
mhl_sii8620_8061_drv.ko
texfat.ko

Copy SuperSU

16. Copy latest SuperSU*.zip to the rootkernel folder

17. Also copy the SuperSU*.zip into your phone's SD card

Patch the kernel

18. Open cmd and cd to rootkernel folder or create a .bat with this command

rootkernel kernel.elf kernel-patched.elf

19. disable dm-verity, don't disable RIC, install TWRP, install busybox, install DRM fix

Prepare windows flash / fastboot mode drivers

20. (Windows 10) Disable driver signature enforcement by using CMD in admin mode

bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS
bcdedit.exe -set TESTSIGNING ON
(reboot)

21. (Windows 10) After rebooting windows, you should see "test mode" in the bottom right corner.

22. Install drivers in C:\Flashtool\drivers

(EDIT: You can self-sign with the Zadig tool and re-enable secure boot, select S1Boot fastboot and driver is the default WinUSB, details see: http://zadig.akeo.ie/)

Flashing files

23. Turn off your phone and boot into flashmode (volume down)

24. Flash the E5823_32.4.A.0.160.*.ftf in "%USERPROFILE%\.flashTool\firmwares" (flashtool -> flash mode)

Important: Remove or Exclude all

.Ta

if you want to keep settings and files

25. Flash DK.ftf with flashtool for a more complete restore of DRM-based functionality with the original TA partition backup. (flashtool -> flash mode)

The DK.ftf is made by the TA-*.img from backupTA with this command

flash_dk TA-02042016.img DK.ftf

(open cmd and cd to rootkernel folder or create a .bat )

EDIT: Use flashtool 0.9.22.3 for this purpose, for details see here: https://xdaforums.com/showpost.php?p=71075592&postcount=2196 (Credits to ondrejvaroscak)

EDIT2: You don't need to do this on every update.

To verify, dial *#*#7378423#*#* -> system test -> security -> see "FIDO_KEYS" is "Provisioned" or not

26. Unplug usb and now go to fastboot mode (volume up)

27. Flashtool -> fastboot mode-> DooMLord -> select kernel to flash

28. Flash the kernel-patched.elf (you need to set file type from .sin to .elf to see the file)

29. Now you can turn on your phone

30. Keep tapping volume up or down (not long holding) when booting to enter recovery

31. Install the SuperSU*.zip you copied into sd card earlier.

32. Wipe cache and reboot again