chiark / gitweb /
man: document that ProtectSystem= also covers /boot