Just in case anybody tries it, do not modify restok.conf and attempt an unsigned package install

/usr/sbin/enter_malf: Entering MALF state SECURITY Failed '/var/lib/aegis/restok/restok.conf' signature check

Follow instructions via javispedro's kernel module.