Installing mkosi pulls in pesign, which ships pesign.service, a root daemon that
provides no function I need - I only build images without Secure Boot signing.

Please move pesign to Recommends.

The same applies to systemd-tpm and possibly others, but I can live with those
since none of them introduce a long-running background service. My objection is
to the daemon, not to the package count.

Thanks.

~a