&gt; The OpenSSL team refuses to even use SSL&#x2F;TLS on their website because &quot;they don&#x27;t want anyone to get the slightest illusion that it&#x27;s secure&quot;<p>Eh?<p>1) Visting <a href="http:&#x2F;&#x2F;www.openssl.org" rel="nofollow">http:&#x2F;&#x2F;www.openssl.org</a> automatically redirects me to <a href="https:&#x2F;&#x2F;www.openssl.org" rel="nofollow">https:&#x2F;&#x2F;www.openssl.org</a> .<p>2) The OpenSSL source code is stored in a git repo in GitHub. While this doesn&#x27;t <i>ensure</i> that the code hasn&#x27;t been tampered with, git <i>does</i> make it substantially easier to detect tampering than other VCSs do.<p>3) All of the release tarballs are PGP signed. Verification of the authenticity of these files is just about as automatic as it gets.