I'm coming to the conclusion that /etc should be in a versioned file system (e.g. NILFS), or related tool like etckeeper.