Except that does actually work sometimes. Debian flat-out broke crypto for a couple of releases, yet it appears it was caught first by OpenSSL developers and not the black hats.