installer/main.sh: Check kernel verification before setting dev_boot_signed_only=1.

Since the test can take up to ~15 seconds to run, we run it in background,
and only update the flag after the bootstrap script has run, but before
the we enter the chroot for the first time.

We also move USB/legacy boot warnings to the end of the script.