It would be nice to move the puppetmaster to the backup without having everything skip a puppet run for things to resign. Also, the server cert is currently copied over by hand -- if we rsync /var/lib/puppet/server/ssl then everything will be nicer.