X509 vfy continued

Builds on @lvh's work in #1156. Let's see if jenkins is okay with it.
(I suppose what I'm trying to say is that a wider `//` -> `/**/` may be in order, and, if this doesn't make the buildbotses unhappy, that can happen on a separate PR)