Make verify_hostname take an OpenSSL connection

This is related to issue #1 that indicates that we may need more power to
verify everything we need in the future.

This is grossly backward-incompatible but service_identity is pre-alpha for
exactly these cases.