Do not treat errors as success

As discussed in #65 (at least two problems tackled there, so this does not yet suffice to close the ticket) the function sent to the OTP SSL libraries for supplemental certificate validation should fail by default, not succeed.

I have not been able to generate certificates that demonstrate the undesirable behavior for automated testing, but certificates originally created by @bkerley revealed the problem and were used to test this fix.
Unless we have a style guide that says to omit them, I'd rather have a `_Cert` variable than `_`.

Also, should we still have a catch-all function that returns valid/fail/unknown/something?