Flame motivated me to get around to adding extended key usage support
so that code signing certificates can't be used for TLS server
authentication and vice versa.

R=golang-dev, rsc
CC=golang-dev
https://golang.org/cl/6304065