This is where it belongs, and soon we'll need to use the same code in
a scenario hook, and calling a step in such a way makes me
uncomfortable.

(FWIW, this is a remnant from the good ol' unmerged
test/firewall-check-tag branch.)