> We can accept only hashlib functions, and continue passing their names 
> to the OpenSSL backend. A bit ugly and limited solution (no user-defined 
> hash functions) for a better looking API.
What I'm doing at the code for my employer is something similar.  There is a PBKDF2 implementation on top of the hmac module.  If a hashlib constructor is detected that OpenSSL implements it dispatches that to the PBKDF2 path in OpenSSL via ctypes.

Ultimately it's the same situation but it does not expose the implementation detail.