Hack to not say success if we never said fail

In the network case we allow one retry.
Only alert of network errors the second time

To help with hosts that have flaky networks
Support ALPN for direct TLS
Need to do handshake for direct TLS case
More diagnostic info
Don't crash if there is no cert chain
Improve suggestion display
If SRV matches known good value, as good as DNSSEC
Usage 1 is fine

It asserts the exact cert same as 3, just also says PKIX should pass
Always include unchecked

So they can be shown as suggestions
Monitor direct tls as well

This was never meant to be commented out
Double the timeout, sometimes Tor is slow
AnyChecked should use Checked not Ok
If any DANE record present, failure is a failure
Fix proxy timeouts
Fix spelling on Tor
Add discuss link and fix CSS
Dedeup records got from different IPs