And now of course, because of the POODLE bug, the latest version of IO:Socket::SSL has version 3 completely disabled. So the above fix is no longer the Right Thing.

It also seems that IO::Socket::SSL now deals better with sites that immediately close or drop connections for bad SSL versions, so it's no longer necessary to force a specific version (which is good, since this is evidently going to be constantly changing anyway). So my code now reads

our %ssl_options = ();
[download]