FWIW I think I'm going to "vendor" Certifi and maintain my own bundle, which is sucky, but at least sucky in a straightforward and not magical way