I've now backported the changes for 3.6.5 to 2.7.15. along with some long
overdue changes made previously in 3.x.  Besides the support for a 10.9+
64-bit-only installer variant (with built-in Tcl/Tk 8.6.x) and other
changes noted above, ee8e4b61d6181f5bfadf6ee3d229f0ebda8a6ae9 also includes
fixes for the following as there were cross-dependencies and it wasn't
worth the effort to try to separate them out into independent commits:

- bpo-24414: Default macOS deployment target is now set by configure to
  the build system's OS version (as is done by Python 3), not 10.4;
  override with, for example, ``./configure MACOSX_DEPLOYMENT_TARGET=10.4``.

- bpo-19019: All 2.7 macOS installer variants now supply their own version
  of OpenSSL 1.0.2; the Apple-supplied SSL libraries and root
  certificates are no longer used.  The Installer Certificate command
  in /Applications/Python 2.7 may be used to download and install a
  default set of root certificates from the third-party certifi package.

I'm satisfied that 3.6.x and 2.7.x are now in sync enough and up-to-date
enough with regards to macOS universal build and installer support that
we can close these and related issues and move on.