I still think that just compiling the latest version, having someone who has the ability packaging it up in CSSU dev/testing and having some people test it out is easier (and better) than having someone try to understand what the openssl code is doing, all the patches, etc...

Unless through testing something is discovered that just doesn't work properly, of course.