diff --git a/board/common/Config.in b/board/common/Config.in
index 70891198..5ce1e8e8 100644
--- a/board/common/Config.in
+++ b/board/common/Config.in
@@ -1,3 +1,9 @@
+menu "Images"
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/common/image/image-itb-rootfs/Config.in"
+
+endmenu
+
 menuconfig SIGN_ENABLED
 	bool "Image Signing"
 	default y
@@ -166,3 +172,4 @@ config SDCARD_AUX
 	help
 	  Create and populate aux.ext4 with rootfs.itbh and rauc.status
 	  For use with a static genimage.cfg for, e.g., SD-cards.
+
diff --git a/board/common/image/image-itb-rootfs/Config.in b/board/common/image/image-itb-rootfs/Config.in
new file mode 100644
index 00000000..fbb04d8d
--- /dev/null
+++ b/board/common/image/image-itb-rootfs/Config.in
@@ -0,0 +1,20 @@
+menuconfig IMAGE_ITB_ROOTFS
+	bool "rootfs.itb+.itbh"
+	select BR2_TARGET_ROOTFS_SQUASHFS
+	select BR2_PACKAGE_HOST_UBOOT_TOOLS
+	help
+	  Create a signed ITB image containing a SquashFS of rootfs
+	  and extract detached header (.itbh) for U-Boot based
+	  targets.
+
+config IMAGE_ITB_ROOTFS_KEY
+	string "signing key"
+	depends on IMAGE_ITB_ROOTFS
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.key"
+	help
+	  Path to the private RSA key, in PKCS#8 format, used to sign
+	  the root filesystem.
+
+	  If the path is prefixed with "<hint>:", then that used as
+	  the "key-name-hint" in the resulting ITB, otherwise the
+	  basename of the path, with any extension removed, is used.
diff --git a/board/common/image/image-itb-rootfs/generate.sh b/board/common/image/image-itb-rootfs/generate.sh
new file mode 100755
index 00000000..ca0c81cb
--- /dev/null
+++ b/board/common/image/image-itb-rootfs/generate.sh
@@ -0,0 +1,71 @@
+#!/bin/sh
+
+set -e
+
+squash="${BINARIES_DIR}"/rootfs.squashfs
+
+itb="${BINARIES_DIR}"/rootfs.itb
+itbh_size=0x1000
+
+IFS=:
+set ${KEY}
+case $# in
+    1)
+	keyfile="$1"
+	hint=$(basename ${keyfile%.*})
+	;;
+    2)
+	keyfile="$2"
+	hint="$1"
+	;;
+    *)
+	echo "INVALID KEY" >&2
+	exit 1
+	;;
+esac
+
+rsanibbles=$(openssl rsa -in "${KEY}" -noout -modulus | \
+		 sed -e 's/^Modulus=//' | tr -d '\n' | wc -c)
+if [ "${rsanibbles}" -le 0 ]; then
+    echo "ONLY RSA KEYS ARE SUPPORTED" >&2
+    exit 1
+fi
+
+cat >"${WORKDIR}"/rootfs.its <<EOF
+/dts-v1/;
+
+/ {
+	description = "${ARTIFACT}";
+	creator = "infix";
+	#address-cells = <0x1>;
+
+	images {
+		rootfs {
+			description = "rootfs";
+			type = "ramdisk";
+			os = "linux";
+			compression = "none";
+			data = /incbin/("${squash}");
+			signature-1 {
+				algo = "sha256,rsa$((rsanibbles << 2))";
+				key-name-hint = "${hint}";
+			};
+		};
+	};
+
+	configurations {
+		default = "verity";
+		verity {
+			ramdisk = "rootfs";
+		};
+	};
+};
+
+EOF
+
+mkimage -E -p $itbh_size -B $itbh_size \
+	-f "${WORKDIR}"/rootfs.its \
+	-g "${hint}" -G "${keyfile}" \
+	"${itb}"
+
+dd if="${itb}" bs=$((itbh_size)) count=1 of="${itb}h" status=none
diff --git a/board/common/image/image-itb-rootfs/image-itb-rootfs.mk b/board/common/image/image-itb-rootfs/image-itb-rootfs.mk
new file mode 100644
index 00000000..ca288d10
--- /dev/null
+++ b/board/common/image/image-itb-rootfs/image-itb-rootfs.mk
@@ -0,0 +1,10 @@
+################################################################################
+#
+# image-itb-rootfs
+#
+################################################################################
+
+IMAGE_ITB_ROOTFS_DEPENDENCIES := rootfs-squashfs
+IMAGE_ITB_ROOTFS_CONFIG_VARS := KEY
+
+$(eval $(ix-image))
diff --git a/board/common/post-image.sh b/board/common/post-image.sh
index 5e273a88..00b84fcc 100755
--- a/board/common/post-image.sh
+++ b/board/common/post-image.sh
@@ -38,9 +38,6 @@ if [ "$SIGN_ENABLED" = "y" ]; then
     load_cfg BR2_ARCH
     load_cfg SIGN_KEY
 
-    ixmsg "Signing SquashFS Image"
-    $common/sign.sh $BR2_ARCH $SIGN_KEY
-
     ixmsg "Creating RAUC Update Bundle"
     $common/mkrauc.sh "$NAME$(ver)" $INFIX_COMPATIBLE $SIGN_KEY
 fi
diff --git a/board/common/rootfs.its b/board/common/rootfs.its
deleted file mode 100644
index a826694e..00000000
--- a/board/common/rootfs.its
+++ /dev/null
@@ -1,28 +0,0 @@
-/dts-v1/;
-
-/ {
-	description = "Infix";
-	creator = "infix";
-	#address-cells = <0x1>;
-
-	images {
-		rootfs {
-			description = "Infix";
-			type = "ramdisk";
-			os = "linux";
-			compression = "none";
-			data = /incbin/("rootfs.squashfs");
-			signature-1 {
-				algo = "sha256,rsa4096";
-				key-name-hint = "infix";
-			};
-		};
-	};
-
-	configurations {
-		default = "verity";
-		verity {
-			ramdisk = "rootfs";
-		};
-	};
-};
diff --git a/board/common/sign.sh b/board/common/sign.sh
deleted file mode 100755
index 0eb37db6..00000000
--- a/board/common/sign.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/sh
-
-set -e
-
-common=$(dirname $(readlink -f "$0"))
-
-cd $BINARIES_DIR
-cp $common/rootfs.its .
-
-mkimage -E -p 0x1000 -B 0x1000 -k $2 -f rootfs.its rootfs.itb
-
-cp rootfs.itb rootfs.itbh
-truncate -s $((0x1000)) rootfs.itbh