anchor.diff:  cannot take any actions that would escalate or allow sideways movement into
   other CNs.
   
  -Threat 3:: An intruder has taken control of a public-facing headnode service
  +Threat 3:: An intruder has taken control of a public-facing core service
   (e.g. CloudAPI), by making use of a vulnerability in that service.
   Goal 3:: The goal is to give this attacker only the minimum access required by
   the normal operation of that service. This means, for example, that CloudAPI
  
positive.code: few contexts in which authenticating individual instances (zones) on the system
  is useful.
  
  This particularly applies in the context of headnode service zones in Triton,
  where it would be desirable for each service to be able to authenticate itself
  to any other service, giving a path forward to eliminate the special "trusted"
  status of all hosts on the admin VLAN.
  
negative.code: 
   * The disks themselves,
   * The key stored in the CN's Yubikey, and
   * Access to the core service.
  
  If any one of these 3 is missing, the key cannot be recomputed, and the data
  cannot be decrypted.
  