Provide OS integration to sign /boot and/or root during updates

Nobody has claimed this yet.

A common paint point in Heads is that when any changes are made, it is difficult to tell if the changes are intentional or due to tampering.

In my opinion, the best solution to this is to eliminate the question. When intentional changes are made, sign them then as part of the update process.

It might be possible for Heads to include or offer integrations for common OSes. E.g. we could build packages for Debian-based, Fedora-based, etc. distributions that would know how to re-sign /boot after an update occurs. Potentially, this could be extended to root also for the root-hashing feature.

For Debian, it is possible to install apt/dpkg hooks that occur before or after dpkg invocations, package installation, etc. (one example: https://unix.stackexchange.com/questions/76294/hook-a-script-to-apt-get). Assuming other package managers offer similar functionality, we could probably export a Heads script and hook it at the appropriate place to integrate signing into the update process.

Alternative to #1599

Review the proposed Debian apt/dpkg hooks and the alternative in issue #1599 first; the issue does not name repository files, tests, or entry points. Done would require a defined integration for one or more common operating systems that signs /boot and potentially root during updates.

Written by the indexing model from the issue text.