If a recovery image is properly signed, it will always work on a given system.  There is no way to lock out that image if it is buggy or vulnerable.

This is intentional, because whatever rollback information is stored on the system could theoretically become corrupt and a recovery image would need to be able to boot to fix that.

But that means that we can't currently lock out old recovery images.

Instead, put the rollback check at the start of the recovery image's initramfs script.  That way, the recovery image will lock itself out before its attack surface grows very far.  And because the check is in the recovery image, in the event that devices are somehow broken in a way which makes the check fail, we can release a new recovery image which works around that breakage.

(This won't help existing recovery images, but it will help new ones...)