coreos-kernel: prune old kernel versions
coreos-kernel: enable module and kexec signature verification

The module verification is in permissive mode by default, loading
unsigned modules will simply taint the kernel. The kexec verification
doesn't directly impact us right now since we are not using the newer
file based syscall right now.
Merge pull request #952 from marineam/secure

Enable kernel module signing