I believe one of those probably applies. > Use of package unsafe. Packages that import unsafe may depend on internal properties of the Go implementation. We r

I believe one of those probably applies. > Use of package unsafe. Packages that import unsafe may depend on internal properties of the Go implementation. We reserve the right to make changes to the implementation that may break such programs. I suspect the crypto code you vendored used unsafe somewhere within it (whether to use `//go:linkname` or for other reasons), which would except it from the go1 compatibility promise.