diff --git a/debian/bin/gencontrol.py b/debian/bin/gencontrol.py
index 0aa687855c43..6584b7cce35f 100755
--- a/debian/bin/gencontrol.py
+++ b/debian/bin/gencontrol.py
@@ -23,6 +23,7 @@ class Gencontrol(Base):
         },
         'build': {
             'debug-info': config.SchemaItemBoolean(),
+            'signed-modules': config.SchemaItemBoolean(),
             'vdso': config.SchemaItemBoolean(),
         },
         'description': {
diff --git a/debian/config/alpha/defines b/debian/config/alpha/defines
index 971b7f0dd3b2..386809d8dcce 100644
--- a/debian/config/alpha/defines
+++ b/debian/config/alpha/defines
@@ -4,6 +4,8 @@ kernel-arch: alpha
 
 [build]
 image-file: arch/alpha/boot/vmlinux.gz
+# linux-signed only works for architectures in the main archive
+signed-modules: false
 
 [image]
 suggests: aboot, fdutils
diff --git a/debian/config/armel/defines b/debian/config/armel/defines
index 70798d5faecf..0a6341a7ee8e 100644
--- a/debian/config/armel/defines
+++ b/debian/config/armel/defines
@@ -17,6 +17,10 @@ install-stem: vmlinuz
 [relations]
 headers%gcc-5: linux-compiler-gcc-5-arm
 
+[marvell_build]
+# Signature verification disabled to save on code size
+signed-modules: false
+
 [marvell_description]
 hardware: Marvell Kirkwood/Orion
 hardware-long: Marvell Kirkwood based systems (SheevaPlug, QNAP TS-119/TS-219, etc)
diff --git a/debian/config/defines b/debian/config/defines
index a2fe96cf46ee..412966a31a89 100644
--- a/debian/config/defines
+++ b/debian/config/defines
@@ -31,6 +31,10 @@ featuresets:
  none
  rt
 
+[build]
+# Enable module signing by default (implemented in the linux-signed package)
+signed-modules: true
+
 [featureset-rt_base]
 enabled: false
 
diff --git a/debian/config/hppa/defines b/debian/config/hppa/defines
index 368576bbe200..67351e67b6d5 100644
--- a/debian/config/hppa/defines
+++ b/debian/config/hppa/defines
@@ -4,6 +4,8 @@ kernel-arch: parisc
 
 [build]
 image-file: vmlinux
+# linux-signed only works for architectures in the main archive
+signed-modules: false
 
 [image]
 suggests: palo
diff --git a/debian/config/m68k/defines b/debian/config/m68k/defines
index d5cddc958fce..dcaef9788508 100644
--- a/debian/config/m68k/defines
+++ b/debian/config/m68k/defines
@@ -6,6 +6,8 @@ kernel-arch: m68k
 
 [build]
 image-file: vmlinux.gz
+# linux-signed only works for architectures in the main archive
+signed-modules: false
 
 [image]
 suggests: vmelilo, fdutils
diff --git a/debian/config/mips/defines b/debian/config/mips/defines
index 74f639ef3e9a..55e0fb7bb013 100644
--- a/debian/config/mips/defines
+++ b/debian/config/mips/defines
@@ -7,6 +7,8 @@ kernel-arch: mips
 
 [build]
 image-file: vmlinux
+# linux-signed should not wait for slow builds
+signed-modules: false
 
 [image]
 install-stem: vmlinux
diff --git a/debian/config/mips64/defines b/debian/config/mips64/defines
index 450568eabb79..5e3d537a8ae3 100644
--- a/debian/config/mips64/defines
+++ b/debian/config/mips64/defines
@@ -6,6 +6,8 @@ kernel-arch: mips
 
 [build]
 image-file: vmlinux
+# linux-signed only works for architectures in the main archive
+signed-modules: false
 
 [image]
 install-stem: vmlinux
diff --git a/debian/config/mips64el/defines b/debian/config/mips64el/defines
index 5b198df8b62b..ca23bfcb5422 100644
--- a/debian/config/mips64el/defines
+++ b/debian/config/mips64el/defines
@@ -7,6 +7,8 @@ kernel-arch: mips
 
 [build]
 image-file: vmlinux
+# linux-signed only works for architectures in the main archive
+signed-modules: false
 
 [image]
 install-stem: vmlinux
diff --git a/debian/config/mipsel/defines b/debian/config/mipsel/defines
index a78c3a8ce916..536455a4aded 100644
--- a/debian/config/mipsel/defines
+++ b/debian/config/mipsel/defines
@@ -9,6 +9,8 @@ kernel-arch: mips
 
 [build]
 image-file: vmlinux
+# linux-signed should not wait for slow builds
+signed-modules: false
 
 [image]
 install-stem: vmlinux
diff --git a/debian/config/powerpcspe/defines b/debian/config/powerpcspe/defines
index adb4bea0733d..e978279a53c8 100644
--- a/debian/config/powerpcspe/defines
+++ b/debian/config/powerpcspe/defines
@@ -5,6 +5,8 @@ kernel-arch: powerpc
 
 [build]
 image-file: vmlinux
+# linux-signed only works for architectures in the main archive
+signed-modules: false
 vdso: true
 
 [image]
diff --git a/debian/config/ppc64/defines b/debian/config/ppc64/defines
index 7efcb1a95b00..86b6b2057ce1 100644
--- a/debian/config/ppc64/defines
+++ b/debian/config/ppc64/defines
@@ -5,6 +5,8 @@ kernel-arch: powerpc
 
 [build]
 image-file: vmlinux
+# linux-signed only works for architectures in the main archive
+signed-modules: false
 vdso: true
 
 [image]
diff --git a/debian/config/sh4/defines b/debian/config/sh4/defines
index e8e5a9e14e69..a50ed413fd55 100644
--- a/debian/config/sh4/defines
+++ b/debian/config/sh4/defines
@@ -6,6 +6,8 @@ kernel-arch: sh
 
 [build]
 image-file: arch/sh/boot/zImage
+# linux-signed only works for architectures in the main archive
+signed-modules: false
 
 [image]
 suggests: fdutils
diff --git a/debian/config/sparc64/defines b/debian/config/sparc64/defines
index 607a267e3fa5..cd4d9df6a5c4 100644
--- a/debian/config/sparc64/defines
+++ b/debian/config/sparc64/defines
@@ -6,6 +6,8 @@ kernel-arch: sparc
 
 [build]
 image-file: arch/sparc/boot/zImage
+# linux-signed only works for architectures in the main archive
+signed-modules: false
 
 [image]
 configs: