Make verify_hostname take the whole cert chain

This is related to issue #1 that indicates that we may need the whole chain to
verify everything we need in the future.

This is grossly backward-incompatible but service_identity is pre-alpha for
exactly these cases.