ok I confirmed that yes microb-engine is using its own crypto code (NSS) and not openssl so we need to look into that.
It does however tap into the maemosec stuff for its root certificates (makes sense, that way there is only one set of root certificates for the entire device)

As for cssu-stable, does it not install extra stuff like orientationlock/rotation?
I want something that has zero no features whatsoever.