Gilbert, could you try removing the subsystems in the reverse order
of how they're originally installed? So the loop probably should be:

    for s in TPS TKS OCSP KRA CA

The reason is the security domain in the CA must be up during this
process. See also https://github.com/dogtagpki/pki/issues/4329.