start and end BN_CTX so BN_CTX can track func owner of temporary BNs

The docs (https://www.openssl.org/docs/crypto/BN_CTX_start.html) assert this is the way we should use `BN_CTX` (start gets a new stack frame). Since we're not passing this `BN_CTX` instance around this hasn't caused us problems, but we should still fix it.
does this need to be in a finally?