The attached patch (against tip) is a very quick attempt to implement the desired behavior:

* add a "nonblocking" argument to py_getrandom()
* dev_urandom_python() sets this to 0, to request blocking operation
* dev_urandom_noraise() sets this to 1 to request non-blocking

As far as I can tell, dev_urandom_noraise() is only called by _PyRandom_Init() so only the hash secret initialization will be affected.

Victor; can you take a look and let me know what you think? This probably needs some comments etc. before pushing. I'm also a little unsure about the rest of the logic in dev_urandom_noraise - it should probably also be modified to not block in the event that urandom is unavailable.