Accept only SSL certs signed by Google's root CA, EquifaxSecureCA; improve docstring