$ wget -c https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.16.tar.xz \
> https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.16.tar.sign
$ unxz ./linux-5.16.tar.xz
$ gpg --verify ./linux-5.16.tar.sign 
gpg: assuming signed data in './linux-5.16.tar'
gpg: Signature made Mon Jan 10 15:27:10 2022 JST
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Good signature from "Greg Kroah-Hartman <gregkh@linuxfoundation.org>" [unknown]
gpg:                 aka "Greg Kroah-Hartman (Linux kernel stable release signing key) <greg@kroah.com>" [undefined]
gpg:                 aka "Greg Kroah-Hartman <gregkh@kernel.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 647F 2865 4894 E3BD 4571  99BE 38DB BDC8 6092 693E
$ tar xf ./linux-5.16.tar
$ rm ./linux-5.16.tar*

$ cd linux-5.16
$ cp /boot/config-`uname -r` ./.config
$ make olddefconfig
$ make config
$ make testconfig
$ grep ^CONFIG_SYSTEM_TRUSTED_KEYS= ./.config
CONFIG_SYSTEM_TRUSTED_KEYS=""
$ time make -j`nproc` bindeb-pkg LOCALVERSION=-yoga260
  :

real    78m44.895s
user    252m6.477s
sys     24m15.807s
$ ls -s ../linux-*_5.16.0*
 8244 ../linux-headers-5.16.0-yoga260_5.16.0-yoga260-1_amd64.deb      8 ../linux-upstream_5.16.0-yoga260-1_amd64.buildinfo
55876 ../linux-image-5.16.0-yoga260_5.16.0-yoga260-1_amd64.deb        4 ../linux-upstream_5.16.0-yoga260-1_amd64.changes
 1184 ../linux-libc-dev_5.16.0-yoga260-1_amd64.deb
$ sudo apt install ../linux-image-5.16.0-yoga260_5.16.0-yoga260-1_amd64.deb ../linux-libc-dev_5.16.0-yoga260-1_amd64.deb ../linux-headers-5.16.0-yoga260_5.16.0-yoga260-1_amd64.deb

$ sudo sbsign --key ~root/MOK.priv --cert ~root/MOK.pem /boot/vmlinuz-5.16.0-yoga260 --output ~root/vmlinuz
Signing Unsigned original image
$ sudo mv ~root/vmlinuz /boot/vmlinuz-5.16.0-yoga260
$ find /lib/modules/5.16.0-yoga260/updates/dkms/ -type f -print0 | xargs -0 -n1 sudo /usr/lib/linux-kbuild-5.10/scripts/sign-file sha256 ~root/MOK.priv 
~root/MOK.der

$ cowthink -f tux $(uname -sr) | lolcat -p 2
 ______________________
( Linux 5.16.0-yoga260 )
 ----------------------
   o
    o
        .--.
       |o_o |
       |:_/ |
      //   \ \
     (|     | )
    /'\_   _/`\
    \___)=(___/

$ wget https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.16.2.xz -O ../patch-5.16.2.xz
$ xzcat ../patch-5.16.2.xz | patch -p1
$ make oldconfig
$ make testconfig
$ time make -j$(nproc) bindeb-pkg LOCALVERSION=-le9

$ wget https://cdn.kernel.org/pub/linux/kernel/v5.x/incr/patch-5.16.2-3.xz -O - | xzcat | patch -p1
$ make olddefconfig
$ make testconfig
$ time make -j$(nproc) bindeb-pkg LOCALVERSION=-le9
$ sudo apt install ../linux-image-5.16.3-le9_5.16.3-le9-3_amd64.deb ../linux-libc-dev_5.16.3-le9-3_amd64.deb ../linux-headers-5.16.3-le9_5.16.3-le9-3_amd64.deb
$ sudo sbsign --key ~root/MOK.priv --cert ~root/MOK.pem /boot/vmlinuz-5.16.3-le9 --output ~root/vmlinuz
$ sudo mv ~root/vmlinuz /boot/vmlinuz-5.16.3-le9
$ find /lib/modules/5.16.3-le9/updates/dkms/ -type f -print0 | xargs -0 -n1 sudo /usr/lib/linux-kbuild-5.10/scripts/sign-file sha256 ~root/MOK.priv ~root/MOK.der

$ patch -p1 < ../le9-patch/le9ec_patches/le9ec-5.15.patch
$ make olddefconfig
$ make testconfig
$ time make -j$(nproc) bindeb-pkg LOCALVERSION=-le9

• https://wiki.matoken.org/linux/debian/bullseye/linux-5.15