Changed certificate code to keep track of things, more comments, fail if not v3

Interestingly wireshark shows that Python's version of OpenSSL isn't willing to
advertise all of the ciphers we are asking it to. One of which (if I am
interpreting the tor-spec correctly) is required in order to speak to a Tor
relay properly, and the other is meant to show to the relay that we are
capable of speaking v2+.
(For reproducibility purposes: python v2.7.3 on Ubuntu 12.04
ssl.OPENSSL_VERSION reports "OpenSSL 1.0.1 14 Mar 2012")