How to make a signed kernel/module from Ubuntu kernel source?

Hi all,
I am new here.
I have a VM, which is installed with Ubuntu 16.10 LTS x86_64.
The VM is configured to use EFI BIOS, not legacy BIOS. So there are /boot/vmlinuz-4.8.0-59-generic, and /boot/vmlinuz-4.8.0-59-generic.signed.

Now, I want to re-build a 4.8.x kernel to do some kernel feature testing.
I got the Linux-source-`uname -r`package, and edit the kernel configuration, then make, make install, make INSTALL_MOD_STRIP=1 modules_install, to deploy the new-build kernel into /boot/
With VM reboot, I could NOT boot the new system, instead, it went to (initramfs): prompt.

Then, I went back to the old kernel, and found that there is ONLY /boot/vmlinuz-4.8.17, no /boot/vmlinuz-4.8.17.signed.
So, did I missed something? Is there a proper way to build initramfs for the new kernel? Does it need to build a signed kernel for EFI bootup?

Thanks,
-Tao