The awesome avadacatavra is working on a plan right now to move us off of OpenSSL:
https://github.com/servo/servo/issues/7888#issuecomment-2934...
TBH, it's been hard to prioritize work to fix OpenSSL issues when we all knew it was going away from the dependency list. However, I don't think anybody anticipated the scope of work required to get there :-)
Sorry for the inconvenience!