>> The best that could be done is to provide a configuration option (e.g.
>> global variable) that should be treated as a default value, and then
>> leave it to people distributing Python to fill out this variable in a
>> sensible way.
> 
> Actually, OpenSSL already does a similar thing (see issue10443).

This may not be satisfying to users. For example, our Windows
distribution doesn't ship with any certicates (AFAIK); I have no
clue where exactly OpenSSL would be looking for them, either.
People worried about this problem probably would want a way to
fill the list of trusted CA certificates.

Regards,
Martin