Leave enforcing disabled for now, so unsigned modules can still load. This can be switched by adding "enforcemodulesig=1" to the kernel command line.
Josh Boyer