add "self.root_action" to the plugin specification
implement non-interactive key certificate creation during startup if necessary (the produced certificate is still broken)
run stunnel during startup
returned environment warnings are expected to be lists