I may have to fork the Stouts.openvpn role.

I also am not pleased that their easy-rsa tarball is not easily auditable rather than pulling it as a subrepository directly from OpenVPN.

edit: I have audited the easy-rsa tarball. It's still not a totally appropriate way to manage things.