Microsoft can’t stop you from signing images with your own keys.

That’s what I do, and it’s almost entirely automated on Linux these days.