I don't think this change is useful at present. Most applications run with a single
context for the lifetime of the process, so this makes no difference. We (perhaps I) first need to implement automated key rotation, and only then do I think it make sense to worry about attempting to scrub the ticket keys.
I undesrstand @vdukhovni's
concerns. Let's discuss this on openssl-dev before merging this.