The logic on this line is pretty complicated and difficult to read.  Since this logic determines if Puppet signs a certificate request or not, I think we should refactor this logic out into a more clear and easy to understand method.

Ideally, this line will read something like:

```ruby
if ok_to_sign_csr?
  sign csr.name
end
```

Where the `ok_to_sign_csr?` is implemented in a straightforward and understandable way and only returns a boolean value clearly indicating if a CSR should or should not be signed.