* Prepare 17.1.0

* Fix changelog markup

* Removed the deprecated md5 default on CRL.export()

* Doh

* unused import

* fixed tests

* last one

* py3k!!!!!

* Simplify code

* dead code

* unused...

* write imports normally

* try loading trusted certs from a list of fallbacks

pyca/cryptography will shortly begin shipping a wheel. Since
SSL_CTX_set_default_verify_paths uses a hardcoded path compiled into the
library, this will start failing to load the proper certificates for
users on many linux distributions. To avoid this we can use the Go
solution of iterating over a list of potential candidates and loading
it when found.

* capath is lazy loaded so we need to do a lot more checks

This now checks to see if env vars are set as well as seeing if the
dir exists and has valid certs in it. If either of those are true (or
the number of certs is > 0) it won't load the fallback. If it does do
the fallback it will also attempt to load certs from a dir as a final
fallback

* remove an early return

* this shouldn't be commented out

* oops

* very limited testing

* sigh, can't use these py3 exceptions of course

* expand the tests a bit

* coverage!

* don't need this now

* change the approach to use a pyca/cryptography guard value

* test fix

* older python sometimes calls itself linux2

* flake8

* add changelog

* coverage

* slash opt

* dump_privatekey with FILETYPE_TEXT only supports RSA keys

FILETYPE_TEXT is terrible but everyone hold their nose

* also verify it's a pkey

* add to_cryptography/from_cryptography on CRL and X509Req

* add changelog entry

* Fixed #486 -- deprecate the backwards compat names

* remove the docs for these, pretend they don't exist

* CHANGELOG

* Added an API for converting X509 to/from cryptography

* changelog