sign_official_build: retain /boot for EFI devices