add SNI (RFC 6066)
restructure certs/keys; add key/cert generation

NID is also now an exposed type