how to build the "Ultimate" OpenSSL

the previously linked version doesn't implement actually interoperable
version of ChaCha20 ciphers, the linked version does. It also includes
some other non-standard ciphers like EXP1024 enabled by default
the ultimate OpenSSL
kex-sigalg fixup - better verbose messages, force tlsv1.2
force at least TLSv1.0 in curves tolerance test

because to advertise curves to server we need extensions and
extensions are only available in TLSv1.0 or later, we need to force
OpenSSL not to send SSLv2 compatible hello if it thinks it's ok to
do (when there are SSLv2 ciphers present in cipherstring it will try to)