Expose the TLS certificate + other TLS parameters for a resource

Exposing information about the nature of a TLS connection used to fetch a resource could enable a number of useful types of debugging:

1. Allowing for the correlation of improvements to the TLS protocol (such as 0-rtt) with increased performance
2. Allowing for monitoring of the security of the TLS configuration of 3rd party CDNs
3. Assisting in the diagnosis of buggy MITM proxies. For example https://twitter.com/lildingus/status/730490073058291713 documents how we had to work with users via twitter to diagnose Kaspersky's interference with Brotli compression.
4. Allow RUM tools to assist users in diagnosing insecure configurations

This type of information can already be collected by using Flash to open a direct socket to port 443 if the domain exposes a socket policy (https://www.linshunghuang.com/papers/mitm.pdf). This suggests that exposing the same information for resources with Access-Control-Allow-Origin would be a reasonable measure.

Start by reviewing the Resource Timing specification and the issue's four debugging use cases. Determine which TLS certificate and connection parameters should be exposed, along with the required origin and CORS constraints; done means the proposal is specified clearly enough to implement and its security implications are resolved.