diff -u linux-aws-4.15.0/debian.aws/changelog linux-aws-4.15.0/debian.aws/changelog
--- linux-aws-4.15.0/debian.aws/changelog
+++ linux-aws-4.15.0/debian.aws/changelog
@@ -1,9 +1,11 @@
-linux-aws (4.15.0-1119.126) bionic; urgency=medium
+linux-aws (4.15.0-1119.127) bionic; urgency=medium
 
-  * bionic/linux-aws: 4.15.0-1119.126 -proposed tracker (LP: #1955252)
+  * bionic/linux-aws: 4.15.0-1119.127 -proposed tracker (LP: #1955252)
 
   * linux-aws: Make a signed kernel (LP: #1951011)
     - [Packaging] aws: Enable signed kernel
+    - [Packaging] aws: remove handoff check for uefi signing
+    - [Packaging] aws: decompress gzipped efi images in signing tarball
 
   [ Ubuntu: 4.15.0-167.175 ]
 
@@ -341,7 +343,7 @@
     - rsi: fix control-message timeout
     - usb: ehci: handshake CMD_RUN instead of STS_HALT
 
- -- Ian May <ian.may@canonical.com>  Thu, 13 Jan 2022 13:44:46 -0600
+ -- Ian May <ian.may@canonical.com>  Tue, 18 Jan 2022 16:09:28 -0600
 
 linux-aws (4.15.0-1118.125) bionic; urgency=medium
 
diff -u linux-aws-4.15.0/debian/changelog linux-aws-4.15.0/debian/changelog
--- linux-aws-4.15.0/debian/changelog
+++ linux-aws-4.15.0/debian/changelog
@@ -1,9 +1,11 @@
-linux-aws (4.15.0-1119.126) bionic; urgency=medium
+linux-aws (4.15.0-1119.127) bionic; urgency=medium
 
-  * bionic/linux-aws: 4.15.0-1119.126 -proposed tracker (LP: #1955252)
+  * bionic/linux-aws: 4.15.0-1119.127 -proposed tracker (LP: #1955252)
 
   * linux-aws: Make a signed kernel (LP: #1951011)
     - [Packaging] aws: Enable signed kernel
+    - [Packaging] aws: remove handoff check for uefi signing
+    - [Packaging] aws: decompress gzipped efi images in signing tarball
 
   [ Ubuntu: 4.15.0-167.175 ]
 
@@ -341,7 +343,7 @@
     - rsi: fix control-message timeout
     - usb: ehci: handshake CMD_RUN instead of STS_HALT
 
- -- Ian May <ian.may@canonical.com>  Thu, 13 Jan 2022 13:44:46 -0600
+ -- Ian May <ian.may@canonical.com>  Tue, 18 Jan 2022 16:09:28 -0600
 
 linux-aws (4.15.0-1118.125) bionic; urgency=medium
 
diff -u linux-aws-4.15.0/debian/rules.d/2-binary-arch.mk linux-aws-4.15.0/debian/rules.d/2-binary-arch.mk
--- linux-aws-4.15.0/debian/rules.d/2-binary-arch.mk
+++ linux-aws-4.15.0/debian/rules.d/2-binary-arch.mk
@@ -146,10 +146,14 @@
 
 ifeq ($(uefi_signed),true)
 	install -d $(signingv)
-	# Check to see if this supports handoff, if not do not sign it.
-	# Check the identification area magic and version >= 0x020b
-	handoff=`dd if="$(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$*" bs=1 skip=514 count=6 2>/dev/null | od -s | gawk '($$1 == 0 && $$2 == 25672 && $$3 == 21362 && $$4 >= 523) { print "GOOD" }'`; \
-	if [ "$$handoff" = "GOOD" ]; then \
+	# gzipped kernel images must be decompressed for signing
+	if [[ "$(kernfile)" =~ \.gz$$ ]]; then \
+		< $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$* \
+			gunzip -cv > $(signingv)/$(instfile)-$(abi_release)-$*.efi; \
+		cp -p --attributes-only $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$* \
+			$(signingv)/$(instfile)-$(abi_release)-$*.efi; \
+		echo "GZIP=1" >> $(signingv)/$(instfile)-$(abi_release)-$*.efi.vars; \
+	else \
 		cp -p $(pkgdir_bin)/boot/$(instfile)-$(abi_release)-$* \
 			$(signingv)/$(instfile)-$(abi_release)-$*.efi; \
 	fi