It certainly requires some bootstrapping, but it seems like once you've got the certs setup keywhiz should be able to manage updates to those and all your other

It certainly requires some bootstrapping, but it seems like once you've got the certs setup keywhiz should be able to manage updates to those and all your other keys, so you do the annoying work once with what are essentially ephemeral secrets, and then you get to use keywhiz to do all your management thereafter.