v0.7.1

certreader v0.7.1

-chains and -verify now build chains the same way.

The two flags each verified certificates their own way and had drifted
apart: -chains left the key usage at the default while -verify allowed
any, and -chains treated only certificates classified as intermediates
as chain material. Chains are now built once, so -chains prints what
-verify judges and neither can disagree with the other.

Chain building still ignores the hostname, because -chains exists to
show what can be built even when the name does not match. -verify checks
the name separately, which is what lets it report a mismatch as itself.

One visible change: -chains against a self-signed certificate used to
print "0 chains" and nothing else, because such a certificate is
classified as a root and so was never treated as something to build
from. It now says the chain could not be built, and why.