DH numbers

Probably needs some parameter validation. OpenSSL's DH_check appears to do some reasonably cheap looking tests we can copy over.

(Also docs.)