* SECURITY UPDATE: TLS chains using a compromised eMudhra intermediate CA key were accepted - debian/patches/CVE-2026-115557.patch: add Modules/_ssl/distrusted_spki.h, a denylist of the SHA-256 digests of the eight compromised eMudhra intermediate SubjectPublicKeyInfo structures, and enforce it from a new _ssl verify callback installed on every _ssl._SSLContext: a certificate whose SPKI digest is on the list fails verification with X509_V_ERR_CERT_REJECTED. Matching the public key rather than a certificate fingerprint also covers the cross-signed certificates that reuse one of the keys. Backport of upstream gh-160040 / PR 160042, which shipped only in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2; 3.10 is EOL upstream and got no release with it. 3.10.22 keeps the older "keep current verify cb" shape in _set_verify_mode(), which is replaced by upstream's SSL_CTX_set_verify(self->ctx, mode, _ssl_verify_callback), and lists the _ssl dependencies in setup.py instead of MODULE__SSL_DEPS, so the new header is added there - CVE-2026-115557