Conditionally add X509_V_FLAG_TRUSTED_FIRST

This fixes an issue with Fedora 20's 1.0.1e package, which silently backported a single verification flag without incrementing the version number.

I think there's still an error in here, but would like Jenkins/Travis builders to confirm.