During buildout run no network communication is required in order to prepare
fallback certificates, so call kedifa-updater with --prepare-only