Comment 8 for bug 1654598

After several pair-wise discussions with reviewers it is clear that we don't yet have convergence of opinion on what tempest tests are needed here, so I am following Valeriy's suggesion and posting a minimal patch set: proposed functional change plus a skip of the tempest tests that will (properly) fail with the functional change. The skip decorator cites a new bug that says we need to add proper tests. So the technical debt to do these tests will be in our backlog but we can address it and drive consensus more productively in a gerrit review context after we take care of this CVE downstream.