With the previous call-sites in place we don't need this
"fixup" anymore, assuming that interface groups, OpenVPN
and IPsec settings are now consistent under the new state,
which is true, because right now it was enforced by the
rc system anyway.