The lftp package is linked against openssl and built with the --without-gnutls flag, I'm assigning the bug to the OpenSSL maintainer.