* Protect the CA key with a passphrase by default to protect it from a
filsystem compromise. An attacker could still steal the other keys
stored (ie the server's cert key), but not issue new keys.
* This is a good compromise for now.
* Disable auto guessing the external IP in favor of the user explicitly
specifying the server name. Save the servername for client cert
generation later.
* Remove dnsutils from build since dig is no longer necessary. Favor
learn and mean images.
