That's also why auditwheel doesn't include it for manylinux, it's not referenced. This translates to about 200k wheel size reduction, half a meg installed.

This also means we don't actually need to build the libssl portion, iirc it's possible to just build libcrypto, which should speed builds up a bit. I'll check... we could also ponder not building all the legacy algos in libcrypto. We're shipping everything enabled by default, which is pretty much everything, from DES to CAST5 and RC4. I think most of the stuff that's in our libcrypto can't actually be used at all from the libssh side. It would probably be quite reasonable to disable most of them: SSH is only going to use AES or Chapoly, it doesn't need TEA or MD2. (On that topic, I'm not sure if all the X.509 stuff is needed, maybe for kerberos or reading putty-type keys? OpenSSH itself doesn't use X509-style PKI - this would be another massive chunk of code).