apart from the fact that the current openssh issues are pretty much unrelated to crypto code, I'll still stick with not implementing my own crypto, just because

a) I would not have thought of the issue of using a standard library call to load data. b) nobody would have checked my code and fixed it

so in the end, I'd still be vulnerable while openssh is now fixed.