Deal with tails.b.o's X.509 certificate expiring early 2017

Let’s expect that it’ll be renewed in December, possibly before Tails 2.8 (2016-12-13) or shortly after. If the certificate’s CA changes, then we need to have the new CA added by config/chroot_local-hooks/58-create-tails-website-CA-bundle in Tails 2.7 (2016-11-08).

Subtasks

#11810 (closed)
#11811 (closed)
#11814 (closed)

Original created by @intrigeri on 11809 (Redmine)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information