Originally Posted by knc1
As far as I can see (without actual testing) is that the described method only interferes with the in-system updater.
It would not interfere with the other ('auto-pilot') updater in the initramfs.
That updater has its own certificate storage (in the initramfs) which our (MR) certificate addition does not affect.
Yep, really, if PW update was downloaded OTA but neither applied, nor removed (which is true for method used by OP: with upstart script modification), it will be nevertheless applied on reboot (after long power button press or selecting Reboot menu item).
(While in other method, mentioned in my post, update bundle isn't downloaded at all.)