The improvement is 4 (430 to 0.02 seconds) orders of magnitude, and
particularly affects large files specified with the `tls-ca-file` configuration
variable.

The problem was successive string allocations - the for { out += oneChar }
pattern is death to any garbage collector, and there are several allocations
per byte as well(!)

Switching to a `bytes.Buffer` for output (conservatively set to 2x the size of
the input string) and avoiding most addtional allocations and calls to
`fmt.Sprintf` is super-helpful.