> Great, I'm thinking more-or-less the API proposed in PEP 272- the
> exception I'm thinking of is that 'strings' should be substituted for
> 'bytes'- for AES and DES. It gets trickier when talking about public
> key crypto, though. Perhaps something along the lines of
> RSA.new(public_key=None, private_key=None,...), with the resulting
> object supporting encrypt/decrypt/sign/verify operations?

I don't have any opinion right now. I think a concrete proposal should
be initiated and we can iterate from that.
(that's assuming other people agree on the principle, of course)

> If we're likely to have openssl taken out from under us it could save
> us a lot of hassle to plan for that up front.

It doesn't seem very likely in the middle term. In particular, the ssl
module itself is quite tied to OpenSSL's socket wrapping semantics
(including error codes and non-blocking behaviour), so OpenSSL will
probably still be required for SSL sockets.