Nirik is seeing a failure that looks like:
[root@bkernel01 ~][PROD]# journalctl -b -l -u pesign | cat
-- Logs begin at Tue 2017-08-08 18:10:41 UTC, end at Tue 2017-08-08 18:27:17 UTC. --
Aug 08 18:22:25 bkernel01.phx2.fedoraproject.org systemd[1]: Starting Pesign signing daemon...
Aug 08 18:22:25 bkernel01.phx2.fedoraproject.org pesign[11226]: pesignd starting (pid 11227)
Aug 08 18:22:25 bkernel01.phx2.fedoraproject.org pesignd[11227]: pesignd starting (pid 11227)
Aug 08 18:22:25 bkernel01.phx2.fedoraproject.org pesign[11226]: Could not initialize nss: The certificate/key database is in an old, unsupported format.
Aug 08 18:22:27 bkernel01.phx2.fedoraproject.org systemd[1]: pesign.service: PID 11227 read from file /var/run/pesign.pid does not exist or is a zombie.
Aug 08 18:22:27 bkernel01.phx2.fedoraproject.org systemd[1]: Failed to start Pesign signing daemon.
Aug 08 18:22:27 bkernel01.phx2.fedoraproject.org systemd[1]: pesign.service: Unit entered failed state.
Aug 08 18:22:27 bkernel01.phx2.fedoraproject.org systemd[1]: pesign.service: Failed with result 'protocol'.
Signed-off-by: Peter Jones <pjones@redhat.com>
Peter Jones