If a worker starts up and tries to connect to a controller before the
controller has a chance for its rotate roots job to run, it'll spit out
a nasty-looking error. It's harmless (things just retry and then work)
but scary (`tls: internal error`).
Rotating at creation time ensures that it's ready by the time a worker
is able to perform any connection against the cluster port.