Seeing that there is no way for me to verify the authenticity of the signing keys (short of visiting canonical in person), every bit of security helps.
Gonna have to once again Google around to fix the problem or start from scratch with new install or distro. Might just bite the bullet to learn Fedora given it consistently ranks higher in security metrics. Don't know about quality or UX experience, though.
So, distributions and updates have issues in Ubuntu. The very things you want to be painless & secure.
The boot partition is small and Ubuntu doesn't clean out old kernels. You have to do it yourself.
sudo apt-get autoremove
This will remove an old kernel. There may be a better way, because I find if there are multiple old kernels I have to do this multiple times. I also found if I have to remove more than one, it's best to follow with a
sudo update-grub
I previously managed to hose things by removing multiple old kernel versions, seeing a warning about needing to do this, ignoring it, then rebooting. So now I just do it after any autoremove that tosses an old kernel.
This may not be the 100% correct magic ubuntu dance, but it is the one that seems to work for me.
UX should be fine but Fedora uses RPM so might have a bigger risk to end up with broken or incompatible packages, not sure though maybe things improved lately.