Add signing template, patches to fix Lockdown mode, EFI vendor metadata

Given @pmhahn is away I thought of opening the MR, as Colin requested on the mailing list a while ago. This set of changes have been tested by Philipp and myself on amd64.