We use Modules/Setup.local to build the _ssl and _hashlib modules against our an SSL library of our choosing at work using a Setup entry like this:

_ssl _ssl.c $(PY_CORE_CFLAGS) -DUSE_SSL -I%{SSL_ROOT}/include \
	-Wl,--version-script,_ssl.lds \
	-Wl,-Bsymbolic \
	%{SSL_ROOT}/libssl.a %{SSL_ROOT}/libcrypto.a

%{SSL_ROOT} is replaced prior to building using sed to drop in the path to our desired libssl build.

_ssl.lds is a linker script to hide all but the module init function as we are linking statically.

MODULE__ssl {
  global: PyInit__ssl;
  local: *;
};


(all that said, I still see how a configure flag would be nicer for many people even though the existing patch does not look like it would work for our own static linking needs - one reason we do that being to avoid dynamic versioning issues)