Tarsnap implements its own crypto algorithms, partially on top of the SSL bignum functions. This is scary (yet another critical part that needs review) but also

Tarsnap implements its own crypto algorithms, partially on top of the SSL bignum functions. This is scary (yet another critical part that needs review) but also could help it achieve a higher level of assurance because OpenSSL's RSA implementation is a mess and much harder to review. Note I am not saying that it is good to implement your own algorithms, just pointing out the sorry state we're at with existing libraries.