Rewrite verify_service_identity

Please not that this is a private API until it's documented.

The new logic makes more sense and is more informative about failures.  This
should be useful in the future.