u-boot/doc/mkimage.1

137 This can be used to sign images with additional keys after initial image
146 Specifies the directory containing keys to use for signing. This directory
166 Specifies that keys used to sign the FIT are required. This means that they
189 Create FIT image with compressed kernel and sign it with keys in the
190 /public/signing-keys directory. Add corresponding public keys into u-boot.dtb,
191 skipping those for which keys cannot be found. Also add a comment.
193 .B mkimage -f kernel.its -k /public/signing-keys -K u-boot.dtb \\\\
199 Update an existing FIT image, signing it with additional keys.
200 Add corresponding public keys into u-boot.dtb. This will resign all images
201 with keys that are available in the new directory. Images that request signing
202 with unavailable keys are skipped.
204 .B mkimage -F -k /secret/signing-keys -K u-boot.dtb \\\\