Uninstall selfsign CA on upgrade
    
    This will convert a master with a selfsign CA to a CA-less one in
    ipa-upgradeconfig.
    The relevant files are left in place and can be used to manage certs
    manually.
    
    Part of the work for: https://fedorahosted.org/freeipa/ticket/3494