#46 was closed by 1be16d5 which added a --reboot flag which activates the new config, then issues the reboot. I believe it would be better to reboot and not activate at all. Then, once it is up, upload keys.

In my case I have software whose userland programs bind closely to an API in the kernel module. If these two get out of sync, it could cause problems. This could be troublesome if a new version's activation is run.