Remove obsolete comment.

Noticed by Ximin.
design doc: add a section discussing the protocols explicitly, and reword the component section to be a bit more precise
Use M2Crypto connect in place of Python ssl.wrap_socket.

ssl.wrap_socket doesn't provide enough access to the certificate chain;
you can do getpeercert but you can't get at intermediate certificates.

I tried to copy the important OpenSSL calls from newPySSLObject in
http://svn.python.org/projects/python/trunk/Modules/_ssl.c, which is
what gets called indirectly when you do ssl.wrap_socket.
Check every certificate's public key, not only the leaf's.

I put the Chromium kSPKIHash_Google1024 as the only allowed key, as
that's the one I see right now.
ChangeLog for intermediate certificate pins.