We discussed it in IRC a bit (and I got a little education).  I can propose three remedies:

A) back out the Clinic conversion in _ssl.c
B) support Clinic in 2.7 just for _ssl.c
C) do a one-time backport of the Clinic generated code for _ssl.c

IMO these are in my reverse order of preference; I'd prefer C, then B, then A.  But I'm not supporting _ssl.c, you guys are.  And I want you maintainers to be happy.  So I'll abide by / help you in implementing whatever you prefer.

FWIW, option C would mean doing an otherwise-inert backport of the current _ssl.c from trunk to 2.7, so that we could also backport (by hand) Modules/clinic/_ssl.c.  Then, if in the future, when you change _ssl.c you still copy that file over and tweak it.  But: if you change the arguments to a function, you'd have to *hand-edit* Modules/clinic/_ssl.c to match.