Re-sign after updates?

[AlexP11223]

Hi, I have an EndeavourOS (Arch Linux) installation with systemd-boot + dracut, and I want to have a Win11 on a separate SSD, but with Secure Boot enabled (e.g. for some anti-cheats), so I am trying to add Secure Boot support in EndeavourOS via sbctl.

As I understand I simply need to go into the Setup Mode (delete all keys), sbctl create-keys, sbctl enroll-keys --microsoft, and then sign some files.
But what happens after a system update? Do I need to sign again? How should I automate that?
btw I am using an Nvidia GPU with nvidia-open drivers, as I understand it needs to be signed too.

[Foxboron]

This is dealt with a pacman hook as part of the sbctl package.