fixup! many: update secboot and use new key format

secboot/encrypt_sb.go

@@ -115,6 +115,8 @@ func EnsureRecoveryKey(keyFile string, rkeyDevs []RecoveryKeyDevice) (keys.Recov
 		if err != nil {
 			return keys.RecoveryKey{}, fmt.Errorf("cannot find list keys for: %v", err)
 		}
+		// LUKS2 containers created with older snapd have no
+		// tokens, thus no named key slots.
 		hasOnlyLegacyKeys := len(slots) == 0
 		if hasOnlyLegacyKeys {
 			authzMethod := "keyring"