This has been asked by Alexis for a long time now. Despite our best efforts in ensuring that there is no split brain scenario, the fact that we use NFS both as a datastore as well as a quorum server makes it impossible to completely negate the possibility of a split-brain (ie, primary/secondary both decide to get active).
One possible solution often found in other software that have active/pasive failover implement a STONITH mechanism. STONITH = Shoot The Other Node In The Head. This is a callout/hook/external script, that the pbs_server needs to call when it has *already* decided to become active. This script can be customized by an admin to call some site-specific tools/actions that 'shoot' the primary dead, if any alive, partially.