I'm having issues getting SSL certificate verification to fail - even when using self signed certificates, different hostnames, or passing a random root ca.
Therefore I think it is safe to assume SSL certificate verification is broken.

ssl.wrap_socket does not verify the hostname, ssl.match_hostname is not used in the code.

And - the sslmode keywords differ from postgresql sslmode keywords, having at least "verify-full" would be good.