Improve crypto_util coverage

This PR includes commits from #126.
@kuba Yeah... M2Crypto doesn't provide access to SANs in CSRs without writing our own extension.  Given the baseline library, I could only access the subject which will contain at most one name.  (I tried to note that in the docstring for the function).  

In actuality we want to make sure that the set of domains is found in the CSR.  We could extend M2Crypto with swig (I do have experience)... but this will add to the difficulty of deployment and upgrading libraries.

Alternatively, we could scrap the csr_matches_name test (as it is insufficient to guarantee correctness) or we could call out to the openssl binary... (but that is pretty sloppy).

What do you think?