Sounds good to me. If followed through, OpenSSL and libressl portable could possibly converge on practically identical code bases.

It is a little weird though that it's almost the libressl game plan, verbatim. It could literally just say "do whatever libressl" does.

Some of the specifics, like memory management is dangerous, fips code is tangly, win16 support is obsolete, seem a little too familiar. We haven't really tried to make an exhaustive list of issues to fix in libressl. I know there are things we haven't looked at yet. But for the OpenSSL roadmap to match 100% our public work is weird. They haven't found anything to fix that we've overlooked?

Also, there are definitely some problems in OpenSSL that we've identified, but haven't talked about. I'd expect any independent review/roadmap planning to identify them. They're missing from this list.