Only get manually added certificates

[mhils]

It would be great to get the subset of certificates which have been manually added by the user. This would allow to ship software that does public key pinning but still works with corporate TLS appliances, mitmproxy or similar software.

[Lukasa]

+1 agreed. I will talk to the Google Chrome folks to see if I can work out how they handle this on their end, but we should work out what the API looks like.

The issue here is that, in almost all cases, what we want to do is to provide the full set of CAs in the bundle, but then have the HPKP implementation check whether the root cert is in the trust store. This means we need to do comparison of X509 certs. I suppose we could just check whether the DER-encoded bytes of the root cert are the same as any of the user-added ones from the OS trust store.