Move to a cipher suite blacklist (WIP)

This is based on the long set of negotiated changes added to #615.  This adds the blacklist as Sam Hartman proposed at IETF 91.

Closes #612.
Yes, if we want SNI and thus TLS to be as widely deployable as we would like them to be.  We might as well not send the "Host" header or not do DNS lookups in Private Browsing mode.