TODO
====

  * nsupdate: don't fail when one of many nameservers don't work
  * add cleanup hook for extra certificates
  * add manpages for individual dehydrated hooks
  * use /etc/default for dehydrated-cron
  * use /etc/default for dehydrated-hook
  * use settings from _dehydrated.$domain.$tld for automatic configuration
  * allow to configure 'use NS records' or 'use mname in SOA' per zone/tsig