Fix the tls patch not to use a package-level callback

The patch was written with a single-connection CLI tool in mind, and
I forgot to change it while writing bleed_serve.go.

This is the cause of the false-positives issue of the site.

Thanks to @agl for reviewing my code and spotting this!
Import hash modules to support new certificates
Raise timeouts across the board
Long overdue: make the system smarter about safe system detection
add some basic tests
commit the small rolling stats tool I'm using
add .gitignore
Merge remote-tracking branch 'origin/master'