introduced service-sensitive tags to allow key re-puppet runs to avoid interrupting services on key servers