secure_boot: split the secure boot functionality in two parts