to @soby).

*  Add CN validation - instead of a full X.509 certificate, it is now
   possible to pass a common name that will be matched against the CN of
   a cert trusted by the CA store.

*  Order-agnostic cert chain validation and friendlier ingestion of cert
   chains.

*  Minor/internal changes; packaging fix for 2.1.0