milestone 10: doh and dot listeners, cert store with hot reload and cert reload api

tests/fixtures/README.md

@@ -1,8 +1,9 @@
 # Test fixtures
 
-`self_signed_cert.pem` and `self_signed_key.pem` are a **test fixture**. The
-private key is **intentionally committed** to this public repository. It is not
-a secret and it must never protect anything real.
+`self_signed_cert.pem`/`self_signed_key.pem` and
+`self_signed_cert2.pem`/`self_signed_key2.pem` are **test fixtures**. The
+private keys are **intentionally committed** to this public repository. They
+are not secrets and must never protect anything real.
 
 Properties:
 
@@ -11,10 +12,12 @@ Properties:
 - SAN `DNS:localhost`, `IP:127.0.0.1`
 - Validity 36500 days from generation
 
-The loopback TLS test in `src/platform/tls_server.zig` uses this pair. Nothing
-in the shipped binary reads it.
+The loopback TLS test in `src/platform/tls_server.zig` uses the first pair.
+The second pair exists so certificate-reload tests can swap between two valid
+identities (milestone-10 ruling 13). Nothing in the shipped binary reads
+either.
 
-Regenerate with:
+Regenerate with (substitute `2` in both file names for the second pair):
 
 ```sh
 openssl ecparam -name prime256v1 -genkey -noout -out self_signed_key.pem