API for `Fingerprint authenticator added to X.509

requires a SHA-256 fingerprint (as hex, ':' allowed) of the server certificate