Hafnium can't be built in a sysroot as the integrated kernel build can't be told to look in the sysroot for openssl headers.
HOSTCC scripts/extract-cert
#error openssl/bio.h: No such file or directory
This isn't in /usr but inside the native sysroot that I need to tell hafnium to use.