anchor.diff:  cannot take any actions that would escalate or allow sideways movement into
   other CNs.
   
  -Threat 3:: An intruder has taken control of a public-facing headnode service
  +Threat 3:: An intruder has taken control of a public-facing core service
   (e.g. CloudAPI), by making use of a vulnerability in that service.
   Goal 3:: The goal is to give this attacker only the minimum access required by
   the normal operation of that service. This means, for example, that CloudAPI
  
positive.code: To fully protect the Triton admin VLAN against IP and MAC spoofing attacks from
  rogue network hardware, it will be necessary to begin protecting all connections
  with TLS. Part of establishing a TLS connection is verifying the identity of
  both parties to the connection, using X.509 certificates.
  
  The zone TLS certificate signing key is set aside for this purpose. Headnode
  services will generate local keys for use by TLS servers, protected at rest by
  the Soft HSM key. A signed certificate and chain will be obtained through the
  soft token interface to allow these to be validated to others.
  
  It is the responsibility of any Triton service to ensure that it obtains a
  new certificate chain for its TLS server endpoints before the expiry of a
  
negative.code: few contexts in which authenticating individual instances (zones) on the system
  is useful.
  
  This particularly applies in the context of core service zones in Triton,
  where it would be desirable for each service to be able to authenticate itself
  to any other service, giving a path forward to eliminate the special "trusted"
  status of all hosts on the admin VLAN.
  