How to append keys to UEFISettings of a Confidential VM image version

I am trying to extend the Intel TDX RTMR[2] register of a confidential VM. This requires adding a custom kernel module to expose an interface. Hence, I need to append my key to the image version UEFI settings to allow installation of my custom module.

I followed this document to create a image version with additional keys.

I use the az cli to create an image version from an existing confidential VM.

az deployment group create --resource-group tdx_group --template-file image_template.json --parameters image_parameters.json

The template is as follows, with a public key added.

{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "galleryName": {
            "type": "string"
        },
        "imageDefinitionName": {
            "type": "string"
        },
        "versionName": {
            "type": "string"
        },
        "sourceVmId": {
            "type": "string"
        },
        "defaultReplicaCount": {
            "type": "int"
        },
        "excludedFromLatest": {
            "type": "bool"
        },
        "regionReplications": {
            "type": "array"
        },
        "location": {
            "type": "string"
        },
        "allowDeletionOfReplicatedLocations": {
            "type": "bool"
        },
        "replicationMode": {
            "type": "string"
        }
    },
    "variables": {},
    "resources": [
        {
            "apiVersion": "2024-03-03",
            "type": "Microsoft.Compute/galleries/images/versions",
            "dependsOn": [],
            "name": "[concat(parameters('galleryName'), '/', parameters('imageDefinitionName'), '/', parameters('versionName'))]",
            "location": "[parameters('location')]",
            "properties": {
                "publishingProfile": {
                    "replicaCount": "[parameters('defaultReplicaCount')]",
                    "targetRegions": "[parameters('regionReplications')]",
                    "excludeFromLatest": "[parameters('excludedFromLatest')]",
                    "replicationMode": "[parameters('replicationMode')]"
                },
                "storageProfile": {
                    "source": {
                        "virtualMachineId": "[parameters('sourceVmId')]"
                    }
                },
                "safetyProfile": {
                    "allowDeletionOfReplicatedLocations": "[parameters('allowDeletionOfReplicatedLocations')]"
                },
                "securityProfile": {
                    "uefiSettings": {
                        "signatureTemplateNames": [
                            "MicrosoftUefiCertificateAuthorityTemplate"
                        ],
                        "additionalSignatures": {
                            "db": [
                                {
                                    "type": "x509",
                                    "value": [
                                        "Base64 Certificate"
                                     ]
                                 }
                            ]
                        }
                    }
                }
            },
            "tags": {}
        }
    ],
    "outputs": {}
}

However, Azure rejects with the following error:

{"status":"Failed","error":{"code":"DeploymentFailed","target":"/subscriptions/883f*fc1c3/resourceGroups//providers/Microsoft.Resources/deployments/image_template","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"InvalidParameter","target":"galleryImageversion.properties.securityProfile.uefiSettings","message":"This parent Image Definition has security type 'ConfidentialVM' and does not support UefiSettings. UefiSettings is only supported by TrustedLaunchSupported, ConfidentialVmSupported or TrustedLaunchAndConfidentialVmSupported security types."}]}}

How can I customize the UEFI settings and kernel in this case? Or is there any other approach to extend the Intel TDX RTMR[2] from user space?