If the linux kernel is compiled to check for kernel modules signing, it checks the validity of the public key (X.509) w.r.t the current system time. For the first time the system is booting up, it hasn't received external time sync and the default time is still 1 Jan 1970. I am wondering how is this issue resolved in other implementations using kernel module signing?
The kernel normally gets its first 'base' time from the RTC or Real Time Clock so while it won't be as accurate yet as after the NTP protocol has updated the time. it is sufficient to validate a signature of a certificate. you can set this value normally in the BIOS before ever booting an OS.