Now, about the "confused signature" of SSLSocket.read().

I'm not sure how confused it is.  It's sui generis; SSLSocket doesn't
inherit from some other class with a different read() method with a
different signature.  But we could change the name, perhaps to
"readbytes", or something similar?  I wrote it the way I did to keep
some kind of compatibility with pre-3.0 uses of the SSL module.

Anyway, the error is coming from a bug in the implementation of
'suppress_ragged_eofs'.  The code in SSLSocket.read() that handles the
EOF error needs to return the right kind of value.  I've added it to the
patch.