This was done in early 16.7, seems to work fine so finish the
transition, dnsmasq is next...

Controls only reload the service, the reconfigure page is in charge of
tracing down dependencies...

There may be more, at least I don't see the difference between
TLS and shared key for most settings, except certificate setup.

The client traffic redirect is probably also wrong, but for now
provide consistency with TLS.

PR: https://forum.opnsense.org/index.php?topic=3908.0

o > 16 hours of randomisation is too much, let cron jobs
  run within 15 minutes.
o Move to `jot' utility for better visibility/portability.
o switch the default bogons invoke to right now, only
  defer the run if `cron' argument was given.

(it's complicated)

There's more we can do with this, but let this sink in for a bit.

The main goal was to provide all changelogs, signed and verified,
to be resilient against phishing attacks on mirrors or MITM means.

Submitted by: @fbrendel