shim-signed

• Packaging for the signed shim
• The end of a long pipeline
• We currently have dual-signed shims
• Signed with both of the UEFI CAs
• Verify and combine sigs during build
• But the next shim won’t be dual-signed
• Preinst checks for boot safety:
• Will this shim boot on this machine?