If `$pulp` is true, then both `certs::pulp_child` and `certs::apache` appear to be declared. Could we wrap the tar-ing of those two into a check for that since it's a defined parameter? Similar question around puppet/proxy.