This addresses CVE-2018-10903:
A flaw was found in python-cryptography versions between >=1.9.0 and
<2.3. The finalize_with_tag API did not enforce a minimum tag
length. If a user did not validate the input length prior to passing
it to finalize_with_tag an attacker could craft an invalid payload
with a shortened tag (e.g. 1 byte) such that they would have a 1 in
256 chance of passing the MAC check. GCM tag forgeries can cause key
leakage.
... although snappass isn't affected because we doesn't use the
vulnerable `finalize_with_tag` API.
- "{}".format('foo') does not work on python2.6, as the index needs to be explicitly specified.
- assertIn(x, y) was only introduced in 2.7, reverting to assertTrue(x in y)
Updated test environments definitions and docs accordingly.
With only 3.5, travis-ci works, because 2.7, 3.3 and 3.4 interpreters
are present by default, but it might break randomly at some point.
Definining all the versions explicitly, and using the tox-travis plugin
is more robust.
Also, 2.6 was removed from the "officially supported" python versions,
as the tests are not run (and don't pass).
