Got started on the cert validation. Current idea is just to dump the
certificate as PEM (as it is bit more user-friendly than e.g. BER/DER)
in case an error is encountered. Then, e.g. HNCP can ask for verdicts
on that cert for awhile. However, how to do this in
SSL-library-neutral way is an open question..