The solution is for launchpad to do as safenode-manager and upgrade one node and restart it immediately then move onto the next. If safenode-manager kills all at once then restarts then it should do it one at a time as well
This way the time is in terms of a minute or two which should not see it shunned by any other node.
Temp shunning is another attack vector. In blackout situations or long term stoppage then the node should know from its logs it was stopped for a long time and use the old secret_key to decode its record_store and restart with new secret_key for a new peer_id and re-encode its record_store while offering up its records.