Is there any way to specify a list of trusted certificate authorities when making HTTPS request from Python on App Engine?
Alternately, is there any other way to secure (against sniffing, replay, MITM, etc) App Engine communication with a 3rd party server without involving a 3rd party CA?
Not currently. You can choose whether or not to validate the host certificate, but you cannot choose which root certificates are accepted.