If my memory serves me correctly, I think it was ipa-server-trust-ad. Maybe I had wrongfully assumed that it got installed as part of the replica setup process? After all, the master already had that running.