prechroot.sh had setupssh.sh commented out and copied only the keys inline, so nodes came up without shosts.equiv, without the CA in ssh_known_hosts and without a setuid ssh-keysign.
Markus Hilger