OpenSSL is not misuse resistant, nor is it opinionated. Opinionated means the ciphers available are the best of the bunch. Misuse resistance means the API vali

OpenSSL is not misuse resistant, nor is it opinionated. Opinionated means the ciphers available are the best of the bunch. Misuse resistance means the API validates parameters and reduces the footguns. If you're doing a closed ecosystem, you'll want both. Use something like libsodium, or it's higher level wrappers. For this the team should have decent understanding of the primitives of that high level library to e.g. know that insecurely generated keys are still accepted so you'll have to use a CSPRNG. If you're having to interact with other systems that only support e.g. TLS, you'll want to have the company hire a professional cryptographer with focus on applied cryptography to build the protocol from lower level primitives. Other programmers should refuse to do this work, like non-structural-engineers refuse to do structural engineering because they know they'll be held responsible for doing work they're not qualified.