Second try on PKI rewrite

This time, role supports parallel execution on hosts and can correctly
redistribute signed certificates from one CA back to correct hosts due
to addition of "route scripts" which convert Ansible tasks into small
Bash scripts run on Ansible Controller.