Remove VeriSign Class 3 CA from trusted certs

Removing the VeriSign Class 3 Public Primary Certification Authority
certificate since as of December 1, 2015, Symantec has decided that this
root will no longer comply with the CAB baseline requirements.
For more information, see:
https://googleonlinesecurity.blogspot.com/2015/12/proactive-measures-in-digital.html

Fix incorrect ResponseNotReady exceptions, retry on transient errors.

For socket errors besides Connection Refused, the code will swallow the
error and fall through to a misleading "ResponseNotReady" exception. This
is both incorrect and unhelpful. The code also does not retry on errors that
are potentially transient, ie, Network Unreachable or Address Not Available.

This patch addresses both concerns by raising the socket error so
that application code can handle it appropriately, or retrying if
the socket error is transient.

This likely resolves Issue #284 .

Minor fixes to indentation in the README