Support calculating the expiration tag on a remote host

Depending on where your provisioning scripts live it does not suffice to
run the command locally, or run the risc of multiple truths.
Doc tweak.