Which happens when only re6stnet is restarted. The DIF must even be recreated
if the local certificate has changed, so that we can reconfigure the shim DIF.

Commit 6c4a5443 fixes a routing issue and
as usual, all nodes without exception must either route correctly or die:
in the future, we may want to force all nodes to upgrade.

"passive mode" means that re6stnet is configured to not create OpenVPN tunnels.

- registry: make --dh mandatory
- node: retry if the registry returns nothing (instead of writing an empty file)

I forgot the case where 'config' has slightly different schema.
Now, we don't have any old network left to upgrade.

When 10.42.3.1/24 was configured on 'lo', the kernel accepted packets to
any ip of 10.42.3.0/24, instead of only 10.42.3.1

The old distutils way is not compatible with zc.recipe.egg in develop mode,
because egg_info does not provide any information about such scripts.

This does not increase of any packet because the size of certificate signature
only depends on the size of the certificate key.

With 512-bit hashes, it's still possible to use RSA keys as small as 768 bits.

There is no plan for a default ipv4 route.

This simplify network configuration a lot, and on recent kernels, this fixes
wrong source address for extra interfaces that already have a public IP.

Generating them takes a lot of time and there's no reason to do this by default.
We keep --dh option in 're6stnet' to not break existing configuration.

We consider using sockets to communicate with OpenVPN, via --management option.

db.py -> cache.py
PeerDB -> Cache
peers.db -> cache.db