Killswitch: Per-function short-circuit mitigation primitive

Better tooling for kpatch would be nice tho

IIRC canonical makes patches for official ubuntu kernels but acts like a Chinese restaurant (closed kitchen, orders come in through a small hatch behind the counter)

Clever! I know some will say it's like closing the barn door after the horse left, but having this in place to mitigate future vulnerabilities will be handy.

If I'm a malicious actor that gets root, can I killswitch the killswitch?