Gemini protocol needs "TOFU" certificates

[kallisti5]

Getting user complaints about TLS errors in elinks.

We try to offer a "full certificate", however the chain of trust gets broken as Gemini discourages intermediate certs (and some servers such as agate use DER certificates which disallow even trying to use them)

Clients can validate TLS connections however they like (including not at all) but the strongly RECOMMENDED
approach is to implement a lightweight "TOFU" certificate-pinning system which treats self-signed certificates
as first- class citizens. This greatly reduces TLS overhead on the network (only one cert needs to be sent, not a whole
chain) and lowers the barrier to entry for setting up a Gemini site (no need to pay a CA or setup a Let's Encrypt cron job,
just make a cert and go)."

— Gemini specification at gemini://gemini.circumlunar.space/docs/specification.gmi - § 4.2

[rkd77]

Check this ^ commit, please.

[kallisti5]

Nice! To be clear, it kind of sucks 😆 The logic of the gemini protocol puts browsers in a weird place:
"Do we 'accept' a full chain validation with certs, or do we require TOFU in every case"

Too many "recommends", too few "musts"

Anyway, I think this solves the concerns for the short-term to make it more usable.