sbctl with package manager hook for automatically signing on updates etc.

keys are just stored on the device, for the typical laptop use-case this is good enough (platform key only used by a single device, no MDA or anything like that)