We can force Jim's generic SHA-2 with -DFORCE_GENERIC_SHA2. This patch adds a
way to force OpenSSL over CommonCrypto, using -DFORCE_OPENSSL_SHA2.