All the pieces we needed from AppArmor upstream and from Debian are now in place
in Buster, which allowed me to confirm all the hypothesis made in the previous
version of this text. So let's drop all hypothetical statements and instead
describe the current implementation constraints.