I'm assuming we have `bad_static_spki_hashes` because we might want to use it some day. Let's make sure it works:

- Preload a badssl.com subdomain to make sure it works.
- Add a //net unit test and maybe  higher-level test.