Although there's still no concrete security reason not to use 3, I
think Bleichenbacher has convinced me that it's a useful defense and
it's what everyone else does.

R=bradfitz, rsc
CC=golang-dev
https://golang.org/cl/5307060