TODO
====

  * rework debconf handling similar to ca-certificates to only show and run
    newly added mitigations on package upgrades.
  * rework kernel version checks for stable/oldstable etc.
  * add remaining manpages.
