Index: lib/Makefile
===================================================================
--- lib/Makefile
+++ lib/Makefile
@@ -28,6 +28,7 @@
 	libalias \
 	libarchive \
 	libauditd \
+	${_libbearssl} \
 	libbegemot \
 	libblocksruntime \
 	libbsdstat \
@@ -78,6 +79,7 @@
 	librt \
 	${_librtld_db} \
 	libsbuf \
+	${_libsecureboot} \
 	libsmb \
 	libsqlite3 \
 	libstdbuf \
@@ -168,6 +170,11 @@
 _libcplusplus+=	libc++fs
 .endif
 
+.if ${MK_SECUREBOOT} == "yes"
+_libbearssl=	libbearssl
+_libsecureboot= libsecureboot
+.endif
+
 SUBDIR.${MK_EFI}+=	libefivar
 SUBDIR.${MK_LIBTHR}+=	libthr
 SUBDIR.${MK_LLVM_LIBUNWIND}+=	libgcc_eh
Index: share/mk/src.libnames.mk
===================================================================
--- share/mk/src.libnames.mk
+++ share/mk/src.libnames.mk
@@ -210,6 +210,15 @@
 		osmvendor
 .endif
 
+.if ${MK_SECUREBOOT} == "yes"
+_LIBRARIES+= \
+		bearssl \
+		secureboot \
+
+LIBBEARSSL?=	${LIBDESTDIR}${LIBDIR_BASE}/libbearssl.a
+LIBSECUREBOOT?=	${LIBDESTDIR}${LIBDIR_BASE}/libsecureboot.a
+.endif
+
 # Each library's LIBADD needs to be duplicated here for static linkage of
 # 2nd+ order consumers.  Auto-generating this would be better.
 _DP_80211=	sbuf bsdxml
Index: share/mk/src.opts.mk
===================================================================
--- share/mk/src.opts.mk
+++ share/mk/src.opts.mk
@@ -208,6 +208,7 @@
     NAND \
     OFED_EXTRA \
     OPENLDAP \
+    SECUREBOOT \
     RPCBIND_WARMSTART_SUPPORT \
     SHARED_TOOLCHAIN \
     SORT_THREADS \
Index: tools/build/options/WITH_SECUREBOOT
===================================================================
--- /dev/null
+++ tools/build/options/WITH_SECUREBOOT
@@ -0,0 +1,4 @@
+.\" $FreeBSD$
+Set to build Secure Boot library together with binsign tool.
+Since BearSSL is used as cryptographic backend one needs to set
+path to its src location in lib/libbearssl/Makefile.inc.