Description of problem:

• machine_configuration/mco-update-boot-images.adoc – nit: certificate expiration shouldn't be affected by the bootimage version, should we remove this?

• machine_configuration/machine-config-node-disruption.adoc – the MCO doesn't really validate the policy. The configuration will be interactively rejected at the API level instead if you apply a bad configuration. Maybe clarify so the user doesn't look for errors in the MCO