Comment 12 for bug 1830243

I also wonder if we need secureboot toleration patches in zipl for xenial+ (when it has no signed stage3.bin)

Specifically, it should strip secureboot signatures off kernels or otherwise things might not boot.