update SOA mname
list wolke as a secondary KDC

The kerberos.* and ldap.* cnames are not too important, good clients can
do SRV (nslcd, sssd, krb5)

Todo: check what kind of SSL certificates wolke has
remove radian cnames and old round-robin entries
remove radian (dead)
add SSHFP to abacus
remove sine (hasn't existed for a while)