* /etc/init.d/kexec-load needs to be patched to run at shutdown time too
* Find a nicer way than `systemctl mask kexec.service'
* have kexec-tools support /etc/default/kexec.d/
  https://bugs.debian.org/752790
* have memlockd enabled on Jessie and testing/sid
  https://bugs.debian.org/714957
  In the meantime, one needs to manually:
  systemctl enable memlockd.service
