Use tbssh instead of ssh, call TBScriptUnlock(), and check that we
really are root when running the proxy on ops.