Code review comment for ~juliank/shim/+git/shim-signed:alternatives

Regarding the design decisions, please see the ubuntu-devel thread. I think most of the complexity is in actually checking if we are good to install, so this is not a lot more complex than aborting in preinst but means it works fine if kernels and shim are upgraded in the same upgrade run, like setup_alternatives + hooking it into the kernel postinst.d is less code than putting up a debconf dialog with an error message :)

In a month or so, when we're sure everyone has upgraded their kernel we could remove the alternatives again and abort in preinst so that people can find out more easily that they're actually using shim 15.7 and not the old version.