That scenario is more complex and has more implications than just
renewing the key. It *also* includes cert revocation so it's implicit
as well.

thanks weasel for the instructions

The multi-user.target does not exist in user-level systemd services,
so this Install configuration never triggers.

They assume a lot of prior knowledge. In particular, they do not show
how to create an account.

When weasel told me about this, he did say it was optional. And in
practice, nevii is fast enough: it runs `ud-replicate` every 5 minutes
(like everyone else) and so syncs DNS changes with the LDAP server
fast enough so that we don't need ot bother with this.

This makes it easier to edit the copy-paste.

The grml-debootstrap install process properly sets up sources.list
with security upgrades, and we should expect the same of any install
process.

That's a pre-requisite of the new-machine setup, which we failed to
fulfill.