The caller could pass the functions (and build the evp_pkey or rsa_cdata) but we also need to know if we're encrypting or decrypting for error handling. The type of operation could also be implicitly determined by checking if it's an RSAPublicKey (encrypt) or RSAPrivateKey (decrypt).