> The best that could be done is to provide a configuration option (e.g.
> global variable) that should be treated as a default value, and then
> leave it to people distributing Python to fill out this variable in a
> sensible way.

Actually, OpenSSL already does a similar thing (see issue10443).