It seems to me that it would be a good idea to notify root upon upgrade
to a security-fixed kernel so the admin knows to reboot the machine. It
could take place in the form of an email at the simplest. (or News.Debian)
It would then be simple to compare the date of the mail with uptime (or
versions) to be sure the patch actually happened.
Are there any other security updates that might require reboots or
otherwise that admins should know about? It seems all daemons restart
themselves.. What about running daemons that depend on security-fixed
libraries?