PEP 466: narrow scope, add legacy SSL branch
PEP 466: cover OpenSSL compatibility