gnutls_pkcs11_obj_flags_get_str: mention UNWRAP
pkcs12: Allow verification with structures that support other than HMAC-SHA1 MACs.
tests: test the decoding of a PKCS #12 structure with SHA256 MAC
tests: updated string to keys tests for new internal API
mac_to_entry -> _gnutls_mac_to_entry
doc update
gnutls-cli: removed salsa20 from the benchmarked ciphers
gnutls-cli: more organized printing of cipher benchmark output
when checking the hostname of a certificate with multiple CNs use the "most specific" CN

In our case we use the last CN present in the DN. Reported
by David Woodhouse.

https://bugzilla.mozilla.org/show_bug.cgi?id=307234#c2
tests: check that gnutls_x509_crt_check_hostname() will correctly use the last CN when multiple
Follow the rfc6125 requirement that a single CN must be present for hostname verification.
Follow the rfc6125 requirement that a single CN must be present for hostname verification.

Follow up on the original commit that simplifies checking for more than a single
hostname.
gnutls-cli/danetool: added a common check for hostname being an IP
doc update
gnutls-cli/danetool: corrected check on ipv6 IPs
The environment variable GNUTLS_FORCE_FIPS_MODE can be used to force the FIPS-140-2 mode
doc update
gnutls-cli: added --fips140-mode command line option

That option will report the status of the FIPS140-2 mode in the library.
symbols.last: added private entry