So, my first boards came back with some horrible mistakes, due to me mixing a PFET schematic symbol with an NFET footprint. My second board requires a bodge or two, as well, and I want to move the mounting holes and some other components, but basically, the thing works as I intended.
The board itself is basically designed as an Arduino that just so happens to control a big switch attached to Anderson Power Poles. In addition to the DC control, there is an optoisolated triac for an AC device, and a couple of LEDs you can switch. The DC is fused with a 30A ATO fuse and the AC is fused as well. The unit also records the 12V voltage. There is a normal, ridiculous, Arduino header set, as well as a special header to match a Raspberry Pi. There is also a 5V regulator so that you can power the Ard (and optionally, the Pi) from the DC input, but you can also jumper select to program the Ard from the Pi. (This is useful if you intend to use the AC output to turn the 12V PSU off).
Communication with the RPi is over the i2c pins, but there are jumpers for using serial or the Ard's SPI pins, too. It should even be possible to program the Ard in-circuit from the RPi, though I have not tried that yet. Over the i2c pins, I decided, for fun, not to use i2c, but to bit bang my own little protocol. It seems to work OK, but I might switch over to i2c which may be faster.
The RPi is running Raspbian Jesse. There is a server running in Python, which communicates with the Ard and which hosts a webpage and a few endpoints to collect system status and to change registers. You open the webpage at your remote location. Browser periodically does a background XmlHttpRequest to the Rpi server and if the watchdog is nearing timeout, it resets it. There are other options, but the basic idea is that in normal operation, as long as your Internet connection to the RPi is good, the device will keep getting pings and will stay up. If something goes wrong, your POSTS to the RPi will stop getting through, and eventually the Ard watchdog will time out and clear any unmasked output bits. Similarly, if the RPi loses internet or crashes, the Ard will eventually time out and shut down.
Lots of work still to do, but it is in a usable state for my purposes. I had fantasies of making this into a kit, but I see that the polish to get there is a lot of effort. Also, I have no idea if anyone else wants something like this.