I'd like to think on it for a bit. My concern is backing ourselves into a problem where we've made this assumption about openssl, and then someone wants to add CommonCrypto or whatever and they've got to refactor everything. I don't want to put that onus on them if we can mitigate it in someway.

In otherwords: lets think a bit more