[scrollaway]

phk had a talk (at fosdem I believe) a few years ago in which he stressed that the easiest way for the NSA to "create" vulnerable code is to push out bad, unnatural APIs with horrendeous defaults into OpenSSL.