Ckozak/avoid writing repo

Still needs tests

Comments are appreciated. I wish there were an easier way to compare configs.  I like using configparsers, because if we're just changing comments/whitespace, we shouldn't rewrite.

It seems less-than-awesome that we have to re-read the file off disk, but it's possible that we'll get a change, (cert defaults), then change it back to the original value (repo overrides).