To save time and improve reliability while building CPython, we should pre-build and sign OpenSSL and Tcl/Tk binaries and make it a binary dependency.

Our slightly-patched sources will still be available, and it will be relatively easy for people to download and rebuild them, but for most cases (particularly CI/buildbots) we will be able to reuse prebuilt binaries.

Since they need to be signed, this basically means it's my responsibility to update the GitHub repo whenever we update Tcl, Tk, Tix or OpenSSL versions. As is usual whenever I get a job, I promise to find a way to mostly automate it :)