db: there *is* no "sane system ca path", or Python would have done that long ago. On Windows, it may be possible to drop OpenSSL, and use the system certificate store. However, that would be a major rewrite, and it may not be possible to provide the entire API anymore.

The best that could be done is to provide a configuration option (e.g. global variable) that should be treated as a default value, and then leave it to people distributing Python to fill out this variable in a sensible way.