Better obs whitelisting

Hi Yan/Mike,

This is my code to fetch copies of the whitelist periodically from s.eff.org, rather than having every single client submit each new common cert as it is deployed.

Should massively reduce the dynamic workload on the observatory server, at the expense of a new static load at s.eff.org.