So we throw away all errors but the most recent? I know we can't match errors in the stack reliably until we strip all asserts but this makes me nervous. Would we avoid this by adding a handle_error in place of every assert or can OpenSSL push more than one error onto the stack for a single API call? I'm guessing it can...