I introduced several build improvements for better support of custom OpenSSL builds in bpo-43466. The issue mentions a new, undocumented, and unsupported hack to create a shared extension modules with statically linked OpenSSL. The Modules/Setup.local trick works with current Python versions, too. Both the hack and the trick hide symbols, too.

I vetoed against official support for static linking because I simply don't have capacity to test and support another build flavor.

William, I recommend that you do NOT read commit bacefbf41461ab703b8d561f0e3d766427eab367 and do NOT use the undocumented hack. Have fun! :)