When a kernel module built out-of-tree is installed, the module signing fails silently because the signing keys are not available in $kerneldir at install time. The key files need to be explicitly copied in a linux-yocto_4.4.bbappend file for the signing to work (see below).

To reproduce:

* Add meta-skeleton layer to bblayers.conf.
* Add 'IMAGE_INSTALL += " hello-mod"' to local.conf.
* In any layer (e.g. meta-skeleton):
- Add a hello-mod_0.1.bbappend file containing 'INHIBIT_PACKAGE_STRIP = "1"'.
- Add a linux-yocto_4.4.bbappend file that includes a .cfg file with the following kernel configuration modifications:
'CONFIG_MODULE_SIG = "y"'
'CONFIG_MODULE_SIG_ALL = "y"'
* Run "bitbake hello-mod".
* Run "hexdump -C " on the newly created hello.ko file - there is no signing information at the end.
* Check the log.do_install log file for hello-mod: it states "certs/signing_key.pem: No such file or directory".
* Add the following lines to the linux-yocto_4.4.bbappend file:
- do_shared_workdir_append() {
    cd ${B}
    mkdir $kerneldir/certs
    cp certs/signing_key.* $kerneldir/certs/
}
* Rebuild hello-mod
* Running hexdump again reveals the text "Module signature appended" at the end.