Yeah understandable. FYI, they're a main player in the package world https://launchpad.net/~ondrej Debian Buster is OpenSSL 1.1.1a so that's good.