Support anonymous certificates.
With DANE they may be just public-key containers.
Cosmetic: inconsistent log format
Preliminary DANE support: per-destination trusted ca fingerprints.
Support for DNSSEC-validated lookups and TLSA RRsets.