The proposed patch with minor changes is now pushed.  I believe all of the review points have either been resolved or are covered by separate pip issues with the exception of item 8.  For item 6 (permissions not being forced), I decided that there are so many other files that are also not having permissions forced that it is silly to single out ensurepip.  Issue15890 should cover a comprehensive solution for all files.  In the meantime, the solution remains to set umask appropriately (e.g. 022) before running "make install" or "make altinstall".  I'm removing "release blocker" status and propose closing this issue once a decision about and/or home for item 8 is found.