if this is a mandatory enforcement, we need to seriously talk about how puppetdb-ssl-setup will work with this tooling.