[opensuse-security] shim bootloader with only SUSE signature?