(PUP-3467) Reject SSLv3

Document as `@api private`, or should we assume the entire class is private?