Let <rule> elements specify an altenative hostname that should be accepted in a cert
For instance, you might want to accept an akamai cert for some given domain that is known to be served by akamai.
This might require an API that doesn't exist yet or it might be possible via the browser's whitelisting mechanism in combination with nsIBadCertListener2 or something equivalent
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information