usable_ca.t: update for current fingerprints (changed after heartbleed), check that we have a usable CA for host in CA store
allow PEM in CA store to contain "X509 CERTIFICATE" or "TRUSTED CERTIFICATE" too