I think I've figured it out.  My initial patch to socket.py and ssl.py
had an extra method defined on socket.socket, _real_close(), which did'
the cleanup work of deallocating the underlying socket, and in the SSL
subclass, of releasing the SSL context.  Guido must have removed that
method, and folded what it does into the socket.close() call.  But that
means that subclasses can't hook onto that code, to get cleaned up
when the socket is truly closed.  So the SSL context gets leaked.

Adding _real_close() back to the socket module fixes most of the leak,
but not all of it.  I'm looking for the other problem...