I don't think we actually want `_on` here. This is always going to execute on the master (well the CA, but that another story...). I think this is probably better named `sign_certificate_for( host )`