Finalize and document -script option

[AGWA]

I think the entire PEM-encoded certificate chain should be fed to the script over stdin. Cert Spotter should ignore broken pipes in case the script closes stdin before reading anything. Question: what if the script forks with stdin still open and never reads?