to @soby).

-  Add CN validation - instead of a full X.509 certificate, it is now
   possible to pass a common name that will be matched against the CN of
   a cert trusted by the CA store.

-  Order-agnostic cert chain validation and friendlier ingestion of cert
   chains.

-  Minor/internal changes; packaging fix for 2.1.0