Test if kernels are signed before setting dev_boot_signed_only=1

This has been discussed extensively in #765.

 - The verification has been modified a little: We check all bootable kernels (instead of hardcoding `KERN-A` and `KERN-B`). This should play better with Chrubuntu.

 - We start the kernel verification process in parallel with bootstrapping.
 - After boostrapping is done, we check the status, and enable `dev_boot_signed_only` if required.
 - We inform the user of the modification in a trap, so it's displayed in all cases.
 - Warnings regarding USB/legacy booting are only displayed on success (it's less critical to display them).

I also provide a test, and the function is put in `installer/functions`, before `###`, so it's not included in `host|chroot-bin` files.