> an OpenSSL cop-out

Perhaps, but they've been doing it this way for a decade+, and we're living in a time when other libraries like BoringSSL are flat-out removing renegotiation support, so good luck convincing them to fix things. Anyway, it's nothing to do with Python, just a friendly heads-up; I ran into this when trying to do renegotiation tests on my non-blocking code using the 'ssl' module and was *very* confused for a while until I realized it wasn't my code's fault at all.