Currently restbase has certificates to encrypt communication between Cassandra nodes, but AQS and Maps don't. Unless there's a good reason to not do so, we should encrypt communication between the nodes - this should simply be a matter of generating certificates and making puppet changes.

However, doing the actual rollout might be a much more fraught operation and we should be sure that it's safe to do (and worth doing). In the case of maps this can be done easily enough by depooling and repooling the clusters as needed, but in the case of AQS this might be a bit more dangerous given its single-cluster nature.