libressl: improved pem handling

If maintainers don’t love the sandbox changes, this would be the
alternative PR I’d create.

Changes:

* Makes LibreSSL non-dependent on Brewed-OpenSSL being available for CA
creation and thus actual useful functionality. This steals the
bootstrapping method from OpenSSL and replicates it for the same
function here.
* Changes some of the handling of HEAD to reflect new upstream
developments.
* Revision to actually make LibreSSL functional, since without a
functioning pem it isn’t a lot of use in real use-cases.