[mirrors] My Universe is no longer cacert!
[ssh] connect to passworded hosts again

that line made it completely unable to connect to non-key remote hosts. oh well.
[keep-net-up] cleanup when service stops
[ntp] refuse all outside connections

previously it would allow some. normally i firewall this anyway, but defense in depth.