Add certificate pinning

New reports indicate that the NSA did, among other hostile actions, MITM several services.

There are also several firewalls that intercept SSL/TLS traffic. The user should be at least alerted by that.

This works even without CAs as it's only bound to a service or host.

SCRAM-SHA-1-PLUS should be the preferred SASL method, with strict warnings if the option disappears.