Allow load_cert_chain to load cert from token

Feature or enhancement

Proposal:

I wanted to implement security token support for ansible but when I digged I saw the missing feature was in python stdlib https://github.com/ansible/ansible/blob/2bb09bfd12e42e7be6f39ab0e45a992512c240f9/lib/ansible/module_utils/urls.py#L505

I can use curl with -E 'pkcs11:model=... it recognize it is not a local file and still can access to pointed file. I configured my openssl to load pkcs11 engine. https://docs.digicert.com/en/software-trust-manager/sign-with-digicert-signing-tools/third-party-signing-tool-integrations/configure-openssl-for-signing-with-pkcs11.html
I can assist anyone wanting help to setup and see the bug.
It seems this code is helpful:
https://github.com/curl/curl/blob/master/lib/vtls/openssl.c#L1339-L1398

I think the error is here:
https://github.com/python/cpython/blob/a9c304cf020e2fa3ae78fd88359dfc808c9dd639/Modules/_ssl.c#L3892-L3898
this function only load file. I can't find it definition in github code search

I understand pkcs11 token might not be widely available and I am willing to contribute. Have you any pointer ? Does python use openssl or I have to resort to dynamic loading like this gist https://gist.github.com/klali/3a20c28c0fc78c924756bfb94b498f1c ?

Has this already been discussed elsewhere?

No response given

Links to previous discussion of this feature:

No response

Start by reading the load_cert_chain implementation in Modules/_ssl.c, especially the file-loading code at the referenced lines, and compare the curl OpenSSL path and the Ansible caller for expected token behavior. Determine the supported API and OpenSSL integration needed for PKCS#11 locations; done requires an agreed design and coverage for loading a certificate from a token.