Some distros have this built-in. Others, and for instance with arch, you can use sbctl which automates most of the process, by having you create keys, enrolling them, and then signing the boot files (this is with the default arch bootloader, systemd-boot).