Thank you @loewis. However, I don't see where set_default_verify_path - is defined in the patch you have provided.

It would also be nice to do something like this:
import ssl
...
ssl._FORCE_VERIFICATION = True

and even better would be to determine the CA path as @pitrou was suggesting and incorporate this into the ssl module somehow.