Currently, when we re-image a node coming out of an experiment, we do the imaging, then we do the basic cluster-specific customization, and then we free the node, and it sits in PXEWAIT til allocated to an experiment.

An alternative approach is to re-image the node, then send it into PXEWAIT. When the node is then assigned to an experiment, we could first drop into an MFS, run slicefix-ng to do experiment specific customization as well as cluster specific. The specific example was to drop experiment keys (e.g. a root keypair) into the filesystem from a "trusted" environment (the MFS). We could remove the quote marks from "trusted" in the future by doing the whole TPM-based chain of trust thing like our trusted disk loading system (TDLS) did.