setup: add pyOpenSSL dep
cli: fix sys.path to allow running from the checkout tree, check py version for all commands