> There is a new "match_hostname" that doesn't implement all the 
> required, standard SSL/TLS Client security checks that should be done.

Indeed, as the name indicates, it just checks the hostname.
Please detail what the other security checks are (bonus points if you provide a patch + tests).

> It has been noticed by the well known security researcher Dan Kaminsky

What's the URL for this?

> A) Integrate the Mozilla CA pack into Python, updating it with each
> security release.

I suggest you discuss this on python-dev:
http://mail.python.org/mailman/listinfo/python-dev