Clarify Secure Boot requirements.

wiki/src/blueprint/UEFI_Secure_boot.mdwn

@@ -11,7 +11,13 @@ enabled, without the user having to do _anything_ special about it.
 Means: use the shim signed by Microsoft + GRUB2.
 
 We don't support booting on a custom built kernel, so that should be
-relatively easy.
+relatively easy. Except:
+
+* The kernel won't allow loading an unsigned `aufs` module so we need
+  to migrate to `overlayfs` ([[!tails_ticket 8415]]).
+* `overlayfs` does not allow stacking enough layers for our current
+  upgrade system, so we need to [[!tails_ticket 15281 desc="stack one
+  single SquashFS diff when upgrading"]].
 
 Resources
 =========