OpenSSL 1.0.2 will be EOL at the end of 2019. Shipping 1.0.2 in 3.5
could really make for a stressful 3.6 release time wise.
OpenSSL 1.1.1 is the preferred upstream LTS release and will be
supported into 2023.
After installing 1.1.1 on my system and rebuilding the broken stuff I
have to say I'm surprised how little breakage I see. Compared to my last
OpenSSL 1.1.0 test, at least.
My list of installed ports that will need need patching is:
cyrus-sasl (patched in 2.1.27-rc7)
spice-gtk (fixed in 0.35)
That's it.
/f