Change the way CA symlinks are handled in 'pki'

I'm not sure what happened here since this set of tasks worked for so
long, but OK, I can update. 'pki' role needs to be revisited at some
point anyway...