Even if 'sed -i' is not posix and we should not use system sed this way:
- even busybox supports this option
- we already use it in so many other places that it does not make sense to
  to impose ourselves such extra dependency

If we plan to fix all 'sed -i', alternatives to [sed] are:
- patch
- 'perl -pi -e' (perl is already built for openssl)

And we should first have a mechanism to prevent misuse of system sed.