Take the secureblue review's adopted set, nine files and a SUID strip
Seed the per-user display config at install, and retire 10-fw12.conf