Should we be deferring to OpenSSL & co to implement this?