Match by fingerprint not order

Sometimes I put my chain certificates in the wrong order.  In https://github.com/glyph/txsni I re-implemented this package but I did it in such a way that it actually honors the private key's fingerprint instead of insisting that the certificate be the first object in the PEM bundle file.  So here's that implementation.