This should let it work for both enabled and disabled configurations

Using AWS is what causes it so using AWS can be what fixes it, too.

... This breaks the tie, thx to https://github.com/DBCDK/morph/issues/146

... that don't have it by default. (<5.6)

This makes wireguard work on older kernels (19.09 nixos), i.e.
our storage servers currently) and newer kernels (21.05, i.e.
the monitoring server).

Fewer lines almost always better.  Also, we don't want to spread
these out unless we have to.

... we'll need this later for the TLS cert.

Use convention to find the file from which the public key can be read.

I was about to make a new repository and complicate CI shell scripts to check
it out in the right place at the right time ... but why?