See my response to tomp - it is deduplicated.

Colin may be a crypto genius and his code extensively reviewed, but I'd wager more eyes have been cast over the openssl codebase than tarsnap.