Implement sslmode=verify-ca

Here's a patch for $SUBJECT according to agl's instructions [here](https://groups.google.com/forum/#!msg/golang-nuts/4vnt7NdLvVU/b1SJ4u0ikb0J).  I've verified that it appears to be working by testing it locally, but I certainly acknowledge the need for automated testing in Travis.