Add specification documentation

Still incomplete, but review may start on the parts that are in there.

Fingerprint definition if still missing

ping @jlhawn 
Self-signed in that the issuer will always be the libtrust managed private key representing the current client or daemon.  The subject key will be the same key for the certificate presented to the remote server.  The subject key will be one of the known hosts or authorized client keys in the case of the generated CA for the pool.  I will try and clarify this in the description.