role::deployment: apply keyholder class

Just the software / services -- not armed with any keys.

Change-Id: I2745e09a082fb0a5af0c8b2d84c35b7af62cf272