The authority makes its own root at first start, and the proxy fetches it through a gate

step-ca's root certificate, its key and that key's password were own secrets — random
bytes the mesh minted, which no certificate is (novox/hq 04-ISSUES/076). The mesh
mints only the CA password now; step-ca makes its root at first start and serves it
at /roots.pem, which the manifest now names beside the ACME directory. The route
proxy fetches that root over the mesh network in a run-once step before it starts,
instead of being handed a served fact that could only be written before anything ran
(ADR 0098).

modules/step-ca/module.json

@@ -13,7 +13,7 @@
   "serves": {
     "acme-ca": {
       "path": "/acme/acme/directory",
-      "root": ""
+      "roots": "/roots.pem"
     }
   },
   "listens": [
@@ -25,10 +25,7 @@
     }
   ],
   "own-secrets": {
-    "password": "/var/lib/mesh/step-ca/password",
-    "root-cert": "/var/lib/mesh/step-ca/root-cert",
-    "root-key": "/var/lib/mesh/step-ca/root-key",
-    "root-key-password": "/var/lib/mesh/step-ca/root-key-password"
+    "password": "/var/lib/mesh/step-ca/password"
   },
   "resources": [
     {
@@ -59,30 +56,6 @@
       "mode": "0600",
       "content": "DOCKER_STEPCA_INIT_PASSWORD=${secret:password}\nDOCKER_STEPCA_INIT_DNS_NAMES=${machine:at},${machine:name},localhost,127.0.0.1\n"
     },
-    {
-      "id": "root-cert-file",
-      "type": "file",
-      "path": "/var/lib/mesh/step-ca/root-cert.pem",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "content": "${secret:root-cert}"
-    },
-    {
-      "id": "root-key-file",
-      "type": "file",
-      "path": "/var/lib/mesh/step-ca/root-key.pem",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "content": "${secret:root-key}"
-    },
-    {
-      "id": "root-key-password-file",
-      "type": "file",
-      "path": "/var/lib/mesh/step-ca/root-key-password.txt",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "content": "${secret:root-key-password}"
-    },
     {
       "id": "server",
       "type": "container",
@@ -95,10 +68,7 @@
       "env": {
         "DOCKER_STEPCA_INIT_NAME": "Mesh Internal CA",
         "DOCKER_STEPCA_INIT_ACME": "true",
-        "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false",
-        "DOCKER_STEPCA_INIT_ROOT_FILE": "/run/mesh/root-cert.pem",
-        "DOCKER_STEPCA_INIT_KEY_FILE": "/run/mesh/root-key.pem",
-        "DOCKER_STEPCA_INIT_KEY_PASSWORD_FILE": "/run/mesh/root-key-password.txt"
+        "DOCKER_STEPCA_INIT_REMOTE_MANAGEMENT": "false"
       },
       "volumes": [
         "/var/lib/step-ca:/home/step",