Has there been any progress on this? For my application I'd very much like "ssh-like" operation, using the public key itself as identifier rather than requiring some kind of automated CA setup.

Being able to set a custom verification callback would be great, but just being able to cause a dummy callback that accepts any certificate to be used would go a long way. The validation could be done after the connection was established in this case. For some applications, that may even be the best approach, presenting any verification error via the application layer (e.g. HTTP) where they are closer to the problem domain and thus make more sense to the user.