how to setup OpenSUSE auto sign?

after running 
```
sudo zypper update
```
```
sudo sbctl verify
```
the output is
```
✗ /boot/efi/EFI/opensuse/grubx64.efi is not signed
```

how can I auto resign it after `zypper` `in` or `update`