I don't have a whole lot to add.  I strongly recommended that this be done this way twice, once when ssl was added to Python and once when ssl was added to tulip, so I'm glad to see it's happening now.  Regarding the specific implementation I am unlikely to have the interest in reviewing the code because I already have a working TLS implementation which does this.  Nevertheless, if it works to get the proactor interfaces to support SSL, then it is almost certainly adequate.

It would be great to eliminate the dependency on OpenSSL's writing-to-a-socket code entirely; Python already knows how to write to a socket, and it probably knows how to do it better than OpenSSL does.

My only further input is that this code should all be deleted and replaced with pyOpenSSL or at least a separate thin wrapper over PyCA's Cryptography bindings.  My Cassandra complex and I look forward to this advice becoming obvious to everyone else in 5-7 years :-).  In the meanwhile, I will de-nosy myself.