Code review comment for ~ubuntu-core-dev/shim/+git/shim-signed:self-signed

Some initial thoughts inline in the code. I haven't reviewed the meat of the update-sb-policy code changes yet, as that's an eye-crossing endeavour that requires coffee, but I'm less concerned about finding shell bugs than I am about overall behaviour, design, and upgrade sanity.