https://www.openssl.org/news/secadv/20160922.txt
This removes the need for curl in bootstrapTools, and enables https for bootstrap tarballs.