I would roll my own. I'm totally confident I can do it better than the OpenSSL team. Of course, I would see what I could do with GnuTLS, first.

In practice, OpenSSL should not be considered secure. At best it can be considered as a way to stop script kiddies.