Check a hostname

Opened by tls.connect() — what the server presents is what we report. No cache, no third-party API.