another thought I had was to give the customer the ability to wipe the nodes certs and request a new cert. that happens from time to time too