This is pretty neat. There used to be free secondary (slave) DNS and it was good. Nowadays not so much and I'm still looking for some way to have secondary ns on a separate network because that's how it's supposed to work.
Well then you could use a sandbox (e.g. bubblewrap) to mount whatever on /etc/ssl. Or you could recompile libressl with a different --sysconfdir and LD_PRELOAD it.
Time to upgrade to LibreSSL. It works just fine and I haven't ran into any compatibility issues lately. The libraries might even work side by side because of the ".50" version number although I wouldn't recommend it.
When your distro is still on 1.1.1\w, now may be the right time to make the switch.