1. Extract the 4.21 EBOOT Resigner.zip.
2. Put EBOOT.BIN into the extracted folder.
3. Run resigner.bat to resign EBOOT, you may need to choose encrypt type.
4. If you chose NPDRM type, you need to enter Content-ID.
5. The original EBOOT.BIN will be renamed to EBOOT.BIN.BAK.
This script is tested on BD4.21 CFW, and it should work on Rogero 4.21.
Some game also contains decrypted self or sprx file, you need to resign them manually.
Credit to badzbb.
Download: 4.21 EBOOT Resigner
Thanks thenat17 for the news tip!