What is the current status of ACs (as defined in X.509 and RFC 575s5) in
OpenSSL? When I did some work using them a few years back (10?) there was
no real support in the mainline; now I have a use case where they look
like a good solution but only if they are well-supported by the tools we
and our customers use (which includes OpenSSL).