Python 3 adoption

It was perfectly possible to write a small patch to add validation by default and allow to pass a custom CA-store, without breaking any existing code. It would have required a couple of dirty hacks inside the library and possibly some code duplication to add support for SNI, but it was entirely doable.

Python maintainers instead backported the whole SSL infrastructure from Python 3 which has a lot of changes inside of it. Here's the patch: https://bugs.python.org/file36423/ssl-backport.diff - it's almost 13000 lines long.