enable Linux kernel gpg verification in grub and/or enable Secure Boot by default

[Patrick]

UEFI Secure Boot support

The necessary features to make this simple were done after the Buster Freeze by some months. This article has the best info on enabling it in Libvirt: https://specs.openstack.org/openstack/nova-specs/specs/train/approved/allow-secure-boot-for-qemu-kvm-guests.html Until then I’ll take a crack at it and see how ready support is now. Here is also Tails’ research on the topic: Preliminary build support for KVM in debootstrap can be bolted on until it is developed upstream.