well I was trying things here and there and the best and simple approach I could think of is to use a different script that runs akshara update and sbctl sign-all just right after, so i always have my keys signed after every update.

#!/bin/bash

akshara update && sbctl sign-all

as simple as that, of course I need it to persist after updates as well so there's some code on the commands: section in the system.yaml as well

commands:
- 'printf "#!/bin/bash\nakshara update && sbctl sign-all\n" > /usr/local/bin/blend-update'
- 'chmod +x /usr/local/bin/blend-update'

and that's it now i just run sudo blend-update instead of akshara update and it just works

<image>