call the client before the server, because it's slower

howto/new-machine.md

@@ -137,15 +137,15 @@ All commands to be run as root unless otherwise noted.
 
  5. bootstrap puppet:
 
-    * on the Puppetmaster (currently `pauli`), run the
-      `tpa-puppet-sign-client` script, which will stop to prompt you
-      for a checksum. it is generated in the next step
-
     * on the new machine run the `installer/puppet-bootstrap-client`
       from the `tsa-misc` git repo cloned earlier. copy-paste the
       generated checksum literally (including the filename) into the
       script waiting on the Puppetmaster above.
 
+    * on the Puppetmaster (currently `pauli`), run the
+      `tpa-puppet-sign-client` script, which will stop to prompt you
+      for a checksum. it is generated in the next step
+
     Note that those scripts are new and haven't been thoroughly
     tested, see [ticket #32914](https://bugs.torproject.org/32914) for details