installer/main.sh: Check kernel verification before setting dev_boot_signed_only=1.

Since the test can take up to ~15 seconds to run, we run it in background,
and only update the flag after the prepare script has run.

We also move USB/legacy boot warnings to the end of the script.