Ignore server-provided root certificates

Fixes #37.
I'll do some work on this branch before merging - I want to make sure we don't do a file read for each cert we read. The bundle can be loaded into memory when the web app is started (or when the CLI tool is run).

The other thing is that it's not technically correct to just look at intermediates. I can't imagine finding a site that only serves a root certificate, but, you never know..