Comment 10 for bug 1624096

Given that it will take a bit of time to get a new shim signed; we'll also need to ship fallback.efi on the CD (and it makes sense to do this anyway), and on disk in general. I've added the tasks for debian-cd and grub2 to do so.