Fixes#982.
Rather than failing immediately if two OCSP responses differ, which can happen
if ocsp-updater fires in between two requests, we wait until all OCSP responses
reach their expected state, and then check for equality.
Additionally, reorganize the OCSP checking to be somewhat cleaner, and improve
detection of verify failures (e.g. when a OpenSSL can't find a signer
certificate).
Jacob Hoffman-Andrews