This is probably okay for adding just the kernel and OpenSSH in the short term, but some packages are more awkward than others to upgrade from stable to stable-backports. We should ensure that we transition to bootstrap-vz before we have to add much more from backports, and that bootstrap-vz puts in place the desired preferences before installing anything. It's not worth delaying this PR to find the perfect solution, but it's worth taking another look during the tool transition.

LGTM from me once you satisfy the above nits from Himanshu and me.