So it looks like we also need a change to base-installer if we want the signed kernel to be installed (absolutely necessary until shim is fixed to work with unsigned kernels on Lenovo machines).
So it looks like we also need a change to base-installer if we want the signed kernel to be installed (absolutely necessary until shim is fixed to work with unsigned kernels on Lenovo machines).