With an env var (probably `CRYPTOGRAPHY_ALLOW_OPENSSL_098`) to allow disabling it for this one release.