* add crl.get_revoked_certificate method

* lexicographic is the best ographic

* rename

* document one shot AEAD length restrictions

* write a test that won't consume infinity ram

continue to raise OverflowError since that's what cffi did.

* this applies to associated_data too

* remove unneeded arg

* review feedback on docs

* document that an ECPublicNumbers object has some unexpected properties

It is not guaranteed to be a valid point on the curve as that is not
checked until you convert it to a PublicKey object.

* different language

* move the text, make it a warning, alter the language

* new language

Duplicate attributes now raise an error instead of silently discarding
duplicates.

* Make the docs clearer on why truncated tags are a bad idea

* clarify

In 2005, IETF devised a more secure padding scheme to replace PKCS #1
v1.5. To make sure that nobody can easily support or use it, they
mandated lots of complicated parameters in the certificate, unlike any
other X.509 signature scheme.

https://tools.ietf.org/html/rfc4055

`_SIG_OIDS_TO_HASH` and `Certificate.signature_hash_algorithm` cannot be
supported as-is, because the hash algorithm is defined in the signature
algorithm parameters, not by the OID itself.

* test against python 3.7 for windows

* update docs to say we test on 3.7

* more succinct

* maybe make this actually work.

* link properly

* moar changes