Upstream can recommend many things. From PoV of SUSE we are targeting product that will include TLS-1.3 (probably openssl-1.1.1) and we need to make sure we can accommodate that on most packages.