Pacman hooks attempting to double-sign UKI files?

Everything is working fine, but I'm curious as to why my system is trying to re-sign UKI files immediately after building them. Here's my output from running 'pacman -S linux'. I've looked through mkinitcpio.conf, mkinitcpio.d, /usr/share/libalpm/hooks, and /etc/pacman.d, but I can't track down this duplicate hook!

(1/5) Arming ConditionNeedsUpdate...
(2/5) Updating module dependencies...
(3/5) Updating linux initcpios...
==> Building image from preset: /etc/mkinitcpio.d/linux.preset: 'default'
==> Using default configuration file: '/etc/mkinitcpio.conf'
 -> -k /boot/vmlinuz-linux -U /boot/EFI/Linux/arch-linux.efi --splash /usr/share/systemd/bootctl/splash-arch.bmp
==> Starting build: '7.2.7-arch1-1'
 -> Running build hook: [base]
 -> Running build hook: [systemd]
 -> Running build hook: [autodetect]
 -> Running build hook: [microcode]
 -> Running build hook: [modconf]
 -> Running build hook: [kms]
 -> Running build hook: [keyboard]
 -> Running build hook: [sd-vconsole]
 -> Running build hook: [block]
 -> Running build hook: [sd-encrypt]
==> WARNING: Possibly missing firmware for module: 'qat_6xxx'
==> WARNING: /etc/crypttab.initramfs is deprecated. Merge it into /etc/crypttab and add a x-initrd.attach option to the devices that need to be unlocked in the initr
amfs.
 -> Running build hook: [resume]
 -> Running build hook: [filesystems]
 -> Running build hook: [fsck]
==> Generating module dependencies
==> Creating zstd-compressed initcpio image
 -> Early uncompressed CPIO image generation successful
==> Initcpio image generation successful
==> Creating unified kernel image: '/boot/EFI/Linux/arch-linux.efi'
 -> Using ukify to build UKI
Using config file: /etc/kernel/uki.conf
+ /usr/lib/systemd/systemd-measure sign --osrel=/tmp/mkinitcpio.OpugJm --cmdline=/tmp/mkinitcpio.LwHkNR --uname=/tmp/tmp.uname77p5tx9l --splash=/usr/share/systemd/bo
otctl/splash-arch.bmp --pcrpkey=/etc/systemd/tpm2-pcr-public-key.pem --linux=/boot/vmlinuz-linux --initrd=/tmp/mkinitcpio.g7Vp4j --sbat=/tmp/tmp.sbatao4exvbe --priva
te-key=/etc/systemd/tpm2-pcr-private-key.pem --public-key=/etc/systemd/tpm2-pcr-public-key.pem
Wrote unsigned /boot/EFI/Linux/arch-linux.efi
==> Unified kernel image generation successful
==> Running post hooks
 -> Running post hook: [sbctl]
Signing /boot/EFI/Linux/arch-linux.efi
✓ Signed /boot/EFI/Linux/arch-linux.efi
==> Post processing done
(4/5) Checking for orphaned packages...
No orphaned packages.
(5/5) Signing EFI binaries...
Generating EFI bundles....
File has already been signed /boot/EFI/BOOT/BOOTX64.EFI
File has already been signed /boot/EFI/Linux/arch-linux.efi
File has already been signed /boot/EFI/systemd/systemd-bootx64.efi