Default to using PKCS7 internally (for compat with older openssl versions).