Comment 4 for bug 431790

yes, if there is a signed kernel binary available that would indeed improve the situation a lot, currently rootstock downloads Packages.gz for armel on the build host, parses that with grep-dctl to determine the package name, downloads the .deb and unpacks it to get the vmlinuz file from it.
having a properly signed vmlinuz from d-i would save me from having all that overhead.