What fence device setup would prevent a mutual-STONITH in a two-node RHEL cluster?

I've got a Red Hat cluster (corosync+rgmanager) software on RHEL 6.6 on physical Dell servers with iDRAC.

This cluster is for stateless application (stunnel, a TLS gateway), so it doesn't need and doesn't have any shared disk. I prefer to keep this cluster as simple as possible, so I rather not add any iSCSI quorum disk (as of now, no qdisk at all).

My cluster.conf contains:

    <cman expected_votes="1" two_node="1"/>

In case my "heartbeat" link totally fails, my tests strongly suggest that this happens:

If both nodes in a two-node cluster lose contact with each other, don't they try to fence each other?

They do. When each node recognizes that the other has stopped responding, it will try to fence the other. It can be like a gunfight at the O.K. Coral, and the node that's quickest on the draw (first to fence the other) wins. Unfortunately, both nodes can end up going down simultaneously, losing the whole cluster. (quote from https://fedorahosted.org/cluster/wiki/FAQ/CMAN)

Can any fencing device assure that such gunfight would only power down a single node? Surely iDRAC or vmWare agents cannot prevent this.

I'm thinking of some IPMI-enabled PDU that only acts sequentially, like this: if there is a request to power down a port, this request waits for all the ongoing power-down requests from others.

I cannot verify this in PDU documentation, but maybe someone have tried it at can recommend something that practically works that way.