>> What OpenSSL needs to do is ... port it to C++ Awful idea. The absolute last thing we want is for memory management to be out of OpenSSL's explicit control

>> What OpenSSL needs to do is ... port it to C++ Awful idea. The absolute last thing we want is for memory management to be out of OpenSSL's explicit control (then we would have two audit trails to worry about). Automatic memory management is manual memory management you've outsourced to somebody else. (By this same argument, you also shouldn't turn on compiler optimizations when you build openssl.)