I know that openssl isn't really consistent in this regard, but zpp failures usually return `null` rather than `false`, so this should be moved below the zpp call.

Personally I'd directly use `RETVAL_FALSE` in the respective branches rather once at the top, so you can see the return value by looking just at one branch rather than the whole function.