Comment 2 for bug 2004437

grub-check-signatures is part of src:grub2 and has been taught to handle gzipped kernels at least in some versions.

Do note that all kernels >= the currently booted kernel need to be signed.