The recovery images check official kernels by comparing a SHA1 digest of the actual kern-b image with a kernel command line option baked into the recovery kernel.

We should upgrade this to use SHA256.

Alternatively (as suggested by a comment in the recovery script) we might get rid of the baked-in good kernel hash and do proper validation the same was as firmware does. On the other hand, there might be a case for binding the recovery kernel to a specific image to install.