WARNING: updating this package has the potential to break boot for all Secure
Boot enabled systems. Any updates to this package should be verifyied to work
with (at least) the following Ubuntu packages:
 * grub2-signed
 * shim-signed
 * linux-signed

If an update to DBX is added to blacklist an Ubuntu binary, then this package
should Breaks on a version less than or equal to the version of the package
that ships the blacklisted binary.

New signed updates should be added to <toplevel source>/data/updates/db for
DB and <toplevel source>/data/updates/dbx for DBX and use a naming scheme like
'<vendor>_<date issued>_<guid>.signed'. Eg:

$ ls data/updates/db    # for an update to DB
canonical_20121126_9963142d-83ed-4585-bc56-3c7a3b095877.signed
$ ls data/updates/dbx   # for an update to DBX
microsoft_20121010_21d2a52c-2940-44b0-8ffa-752671d5abbd.signed

The name of the file is not important to sbkeysync but using this naming scheme
helps with maintenance. On installation and upgrade, sbkeysync will examine the
signed updates in /usr/share/secureboot/updates and add only the missing ones,
like so:
$ sudo sbkeysync --no-default-keystores \
                 --keystore /usr/share/secureboot/updates \
                 --verbose
