Minor changes.
Removed normative language.
Changes after Ted's review:
 - Section 9 (related work) moved to appendix A.
 - Added explanation why failover is limited to a pair of servers
 - softened security considerations section about not relying on
   CA (that may be inaccessible)