alternatively, re-fix rndc to have a local socket so it doesn't _need_ the crypto configuration to talk to the local host, just root is good. it's bothered me that this is necessary now, but it's good our rc.d does the setup for you now days (it didn't for a while), except it now has a new problem...