Custom length certificate changes

[Stebalien]

Currently, we require length two chains where the bottom key (the one used directly in the handshake) is ephemeral. However, RSA signature verification is a bit expensive, especially when rapidly forming many connections (e.g., in the DHT).

It would be nice if we could instead make this configurable:

• By default, we'd start out with this two key system.
• By default, we'd allow anywhere from 1 to 4 certificates in the chain (restricted to 4 to prevent clients from tricking servers into validating long certificate chains).

Motivation:

• Certificate verification can be expensive (depending on the algorithm).
• In the future, peers will likely have an outer "ephemeral" peer ID (generated on boot) and will likely negotiate additional sub-peer IDs later (per application). When using these ephemeral peer IDs, the current two-certificate system doesn't provide any additional security.

[Stebalien]

Deprecated in favor of ephemeral IDs from the start.