Note that you can add --key-admin=true here to make a particular user key-admin for the key

We should add here that when granting key access you should use the autosign/robosignatory passphrase.

Note that these commands are run on bodhi-backend01

phx2 is no more, change to iad2

We now need to make a ima cert signed by our sigul ca and get it to the kernel maintainers. This must be done after the ipa key above is made.

sigul -v -v sign-certificate fedorasigulca fedora-41-ima --issuer-certificate-name fedorasigulca --subject-certificate-name fedoraimafourtyone --validity 2y --certificate-type codesigning --subject "CN=Fedora 41 IMA Code-signing cert" > fedora-41-ima.pem

need to change the name from 41/fourtyone to whatever.

We need to find the best way to get it to kernel maintainers. We can ask them. We Also need to add it to fedora-repos like the other keys.