Oops. It looks like there *was* an easy way to make openssl do what we wanted.