If cryptography can't possibly be figured out once and for all and must remain a moving target forever, I'd separate TLS into a module that can be updated independently of the rest of the system.