This is verified on both master built from source and latest 3.5.0 packages. Description:
Remove /var/cfengine/ppkeys and try to bootstrap. First you get a failure, even though failsafe.cf did generate the keys. Second time you bootstrap it succeeds, because keys were generated.
This bug is not immediately visible because we generate keys on package installation via post-install script, so keys are already there. Beats me why we have 2 ways for doing the same thing, IMHO this is a bootstrapping thing and should be handled there.