In the end, we should migrate completely to cryptography. A lot of bits of the legacy OpenSSL module are being deprecated, some that we use (notably signature and verification tools) already are.