SSL: change pinning to work on public keys, not the whole certificate chain

Previously, the code would compare the whole certificate chain (i.e. including
any CAs) and check not only the public key of each cert, but the certificate as
a whole.

This has a couple of interesting properties:
- The user would be prompted upon changing certs before they expire
- A change of CA would trigger a prompt to the user with varying level of scare

Arguably [1], what shall be pinned is just the Subject Public Key Info (SPKI)
block of the server's certificate.

Now that the code does not necessarily have access to the old cert chain, it
doesn't make sense to check for certificate soon to expire -- the idea is that
the public key does not change in these circumstances.

[1] http://tools.ietf.org/html/draft-ietf-websec-key-pinning-08#section-1

REVIEW: 112041