* Update fernet docs to use latest Django recommendations

* Err, remember how RST works

* OCB3 support in aead package

* improve comment

* Allow parsing CSR extensions with the critical bit having an explicitly encoded default

* Poke for zuul

* Allow to serialize extension values as DER bytes string.

* Prepare test for SignedCertificateTimestamps.

also document that we can return these key types in a certificate,
although they can't be self-signed of course