How do you sign opencore binaries with Secure boot keys?

Hello,

I am trying to get UEFI Secure boot to work with my hack. The hack works just fine. I followed this guide as even though it is mostly about Gentoo, it is helpful to generate and add the initial keys into the bios. But then is where I get stuck. I don't know which file I use to sign the efi files. Am I supposed to sign it with the db, KEK, or PK? Do I use the cer, crt, auth, or auth files? Any help would be great.

​

Thanks.