It seems like portage did remember that those packages were built against that openssl version - when running as "emerge -DavuUN @world @system --changed-deps"

It seems like portage did remember that those packages were built against that openssl version - when running as "emerge -DavuUN @world @system --changed-deps" the problem went away :-) Probably some caching issue/race condition in portage...