You usually don't, unless you demand signed kernels and have a secure method of blocking unsigned ones. But the read-only filesystem issue is something that co

You usually don't, unless you demand signed kernels and have a secure method of blocking unsigned ones. But the read-only filesystem issue is something that could happen by accident rather than malicious alteration - for instance some filesystem errors may result in it being mounted RO for safety until the corruption is addressed.