We don't know what *OpenSSL* thinks the length of the digest is. Ultimately I think that NULL is probably fine but since we are currently chasing weird corruption issues paranoia seems like a good thing.

There will probably be another PR to increase the size of the digest output buffer to `EVP_MAX_MD_SIZE` too since OpenSSL doesn't actually claim to only ever write to the `digest_size` worth of bytes in it.