> That's the part I'm questioning though. I'm not clear why you'd ever do 
> that instead of doing everything on the original socket before invoking 
> ssl.wrap_socket.
> 
> What I missed on the original patch before committing it (mea culpa) is 
> that the SSL part is neither documented nor tested properly (the tests 
> only check that it is disallowed on a secured SSLSocket, not that it
> works on a connected-but-not-secured-yet SSLSocket object).

Bill, do you know?

> The absence of proper tests and documentation is the main reason I'm tempted 
> to just revert those parts of the patch that touch the ssl module and its
> tests.

Then perhaps raise NotImplementedError, so that people know it's deliberate and not an oversight.