shazow/urllib3 — pull request #444 by t-8ch (2014-08-20 20:35:51+00:00)
Title: allow performing *only* fingerprint verification

Before if we verified a fingerprint we also required a valid certificate.
Valid in 'signed by a trusted CA, current time in valid timerange', not in the
sense of matching hostnames.
We should allow people to verify certificates via fingerprints that are totally
crap otherwise.