I think someone with more package-fu will have to get this into cssu-devel. All I did was download the openssl 0.9.8za source and compile it, no patching of existing versions or anything exotic. Is there more involved than a cssu-devel maintainer doing the same thing? (I guess what I'm asking is, is there any reason to not just go with the upstream 0.9.8za version?)

Packaging up a system package like this for cssu is a bit beyond my knowledge at the moment.