allow performing *only* fingerprint verification

Before if we verified a fingerprint we also required a valid certificate.
Valid in 'signed by a trusted CA, current time in valid timerange', not in the
sense of matching hostnames.
We should allow people to verify certificates via fingerprints that are totally
crap otherwise.