This is inspired heavily by `debops.pki` in the https://debops.org project. However there are several simplifications to their way of doing it.