It's been a while since I did this, so it might have changed, but these
are the steps I went through to create the signing keys. It should at
least give you some hints, if nothing else.
A lot of work.
Convert the private key and pem certificate to a pk12 structure.
openssl pkcs12 -export -out kernel_key.p12 -inkey public_key.pem -in xyz_cert.x509.pem