OpenSSL 1.0.1d and above return non-0 values from `openssl verify`

Versions of OpenSSL prior to 1.0.1d always returned 0, even for
certificates whihc did not verify.  Starting with 1.0.1d, a openssl will
exit with a return code of 2 if the certificate chain fails to verify.

Cope by interpreting exit codes of 0 or 2, when not accompanied by an
explicit "OK", as verification failure, not openssl failure.
Additionally, add a trust level of "unknown" if openssl does abort
unexpectedly.