create default context, then load in cert chain if needed

Must call ssl.create_default_context().

Must not call ssl._create_unverified_context(), it doesn't exist in
Fedora rawhide yet.