Follow the Arch wiki. Just make sure that your distro has a hook for the package manager for signing the kernel. Eg. for Arch there's the systemd-boot-pacman-hook aur package.
It's not hard to set it up with a LUKS-enabled system, just put the relevant kernel parameters in your /esp/loader/entries/entry.conf file.
For example, here's my arch.conf entry (with LVM on LUKS):

title    Arch Linux
linux   /vmlinuz-linux
initrd  /intel-ucode.img
initrd  /initramfs-linux.img
options loglevel=2 quiet splash cryptdevice=PARTLABEL=partlabel-from-blkid:pvname root=/dev/mapper/rootlvname rw  

If your keys are already enrolled, you can just use sbctl sign-all once, your package manager hook should do the rest.

Overall, the general directory structure should look like this in the end (files omitted):

/boot
├── initramfs-linux-fallback.img
├── initramfs-linux.img
├── intel-ucode.img
├── loader
│   ├── entries
│   │   ├── arch.conf
│   │   └── arch-fallback.conf
│   ├── entries.srel
│   ├── loader.conf
│   └── random-seed
└── vmlinuz-linux