Looks like that covers it.  The one thing I'm concerned about is that, historically, we've always said "you can point our build system at whatever version of OpenSSL you want and it should work", but obviously this locks us in to 1.0.2+.  Really, there shouldn't be much reason to use anything else, but I'm not sure we want to give up that ability.  I have no idea if anybody actually relies on it though; we could just commit it and backpedal later if anybody complains.