I am not 100% sure, but I think nginx only needs to be compiled with openssl 1.0.2, but does not otherwise care about the presence of 1.0.2 in the system. So maybe the solution will be to just use the nginx repository when it start providing binaries compiled against openssl 1.0.2.