Would it be an idea to just delete all NSR peer information right after the 
server gets its new IP address?



> These are the self-signed certificates which you are stored within the 
> Local Hosts resources.
> So if you see such messages like "An authentication request from 
> <client> was denied. ..." in the daemon.raw file, you should take 
> appropriate action and delete them on all peers.

In nsradmin:

Delete type: NSR peer information; name: <client being complained about>