Improve crypto_util coverage

This PR includes commits from #126.
There's also a possibility that the ACME protocol is going to be changed to stop using X.509 CSRs entirely, and perhaps only use JWK and a list of requested SANs.  The main potential problems with this proposal are that some users already have CSRs or tools that generate them (in which case we'll still need to parse out the data from the CSR, but not transmit it over the wire) and that some users might want to request specific fields or data in the cert (which the Let's Encrypt CA in particular might not want to honor, but which perhaps the protocol and client should have a way to represent).

Anyway, the code related to the use of CSRs within the protocol might well disappear entirely soon if the protocol changes!