The problem turned out to be that -lcrypto was being put in between libdns and
libisc, and needed to be after libisc.

The latest couple of commits in rt45019 address this. It's working for me now.

I haven't had time to test with pkcs11, native or otherwise, but I can try
to get to that later today.