Implement verification of OCSP replies.

The OpenSSL code to do that is a nightmare.