Or, does it merely check that they are signed with librem key?
Both questions answered in a related topic: