...
Choose an EFI application in your edk2 build aritfacts to do the test, or use this EmptyApplication-Riscv.efi
$ sbsign --key DB.key --cert DB.crt --output EmptyApplication-Riscv.efi.signed EmptyApplication-Riscv.efi
Update the sbsigntool to the latest one if you encounter "invalid PE header magic" issue in signing riscv64 binary
...