puppet cert sign lacks hashsum parameter

Hi,

on puppet master the client's public key needs to be signed with puppet cert sign clientname

There's two ways to do it:

1) the interactive way where the sha256 hash sum is shown and a human confirms to have checked this

2) the --assume-yes way to blindly sign a key without verifying.

That's insufficent /insecure if clients need to be registered automatically, e.g. with an external script

there show be a command like

puppet cert sign clientname hashsum

or just

puppet cert sign hashsum

which signs the client only if the hashsum is equal to the one given on command line (e.g. fetched directly from the client)

And on the client side there should be some simple command to display the corresponding hash of the cert request, in order to automatically fetch the hash sum from the client and pass it to the master/server to sign that particular hash.

regards