Find a way to ship LTS kernel instead of the latest one

I don't need latest & greatest in this area, which can introduce some nasty bugs like with AMD GPUs. I have to see how to do that while retaining secure boot support, preferrably from Fedora keys, without having to create my own.