It seems like portage did remember that those packages were built against that openssl version - when running as "emerge -DavuUN @world @system --changed-deps" the problem went away :-)

Probably some caching issue/race condition in portage...