By keeping the listen sockets open, the children were preventing the
daemon from being restarted cleanly. Once the child has forked these
listen sockets are no longer needed by that process, so can be closed.

Otherwise, excluded domains might be silently ignored.

This obfuscates the error message too much.

Useful for subdomains which are handled by the same
mail server.

The secrets file is now parsed line by line, and
each line (excluding CR and/or LF) is used as a secret.
Only the first secret is used for signing, but all
secrets are used for verification.

This is purely cosmetic.

This eliminates a warning about a missing return
statement. The code was correct though, because
hex2num() is guarded by is_hexdigit().