to @soby).

* Add CN validation - instead of a full X.509 certificate, it is now
  possible to pass a common name that will be matched against the CN
  of a cert trusted by the CA store.

* Order-agnostic cert chain validation and friendlier ingestion of
  cert chains.

* Minor/internal changes