Trust on first use

[keis]

• Should directly verify certificates in store provided by caller
• Should accept new self-signed certificates (and notify caller)

[keis]

This is proving to be very hard to do correctly with the builtin ssl module of python because it does not expose the verify callback of openssl. Using pyopenssl would an alternative but asyncio.create_server expects a ssl context from the bulitin ssl module.