openssl is a known source of critical security vulns, because it is implemented in C it's always going to be vulnerable

[zancas]

We need to ensure that openssl is never a dependency.

https://www.lesswrong.com/posts/7aJwgbMEiKq5egQbd/ai-found-12-of-12-openssl-zero-days-while-curl-cancelled-its