Might be a bit cleaner to just put the base64 representation in the config directly - then we could do away with the `auth_key_exists` var, and this task could just be a `- template: src=xxx owner=root` mode=600`.