This can probably be removed, or at least set to zero. cryptography binds X509_V_FLAG_NOTIFY_POLICY and pyopenssl reexports it. But this doesn't do anything. All X509_V_FLAG_NOTIFY_POLICY does is call the verify callback to be called an extra time with ok=2. (Unclear why one would ever want this feature.)

But pyopenssl doesn't install a verify callback (cryptography doesn't even bind it as of pyca/cryptography#8358), so setting it is always a no-op.