virt: preapprove minion keys and better bootstrapping