Distinguish incomplete chains from untrusted roots

At least in a naïve fashion, flagging likely incomplete chains from untrusted roots should be feasible by counting the number of certificates returned in "Certificate Chain Received" from `sslyze`. `requests` may also return something that could be useful.

I recall`openssl` returns a 'depth' value, which, when a _site_ is less than `2` deep, is a strong indication intermediate certs are not served, making the chain incomplete. If depth<2 and the certificate is not trusted in the Mozilla store, this seems to indicate an incomplete chain, while depth>=2 seems to indicate an untrusted root.