Sign with key from USB

[Klaaktu]

I plan to store all the keys on a separate USB, and only sign with the key on USB when the boot loader is upgraded (until Fedora signs their sd-boot eventually...).
Is there a more convenient way to do this, like specifying which file to use for signing? It seems that currently I need to import the key, sign, and then manually remove the key files.

Also, what does "sbctl is installed" mean? What does this do exactly?

[Foxboron]

See the keys entry in sbctl.conf.

https://man.archlinux.org/man/extra/sbctl/sbctl.conf.5.en