chg: fix spelling in the error message about error waiting for cmdserver This is a trivial spelling and grammar fix.

sslutil: document and slightly refactor validation logic This main purpose of this patch is to make it clearer that fingerprint pinning takes precedence over CA verification. This will make subsequent refactoring to the validation code easier to read.

sslutil: require a server hostname when wrapping sockets (API) All callers appear to be passing the hostname. So this shouldn't break anything. By specifying the hostname, more validation options from the ssl module are available to us. Although this patch stops short of using them.