Add kernel module signing on x86
    
    Leave enforcing disabled for now, so unsigned modules can still load.  This
    can be switched by adding "enforcemodulesig=1" to the kernel command line.