See https://www.openssl.org/docs/ssl/SSL_CTX_set_cert_cb.html

Basically, we will be able to eliminate our hello parser and use new APIs for async OCSP/SNI and stuff like that.

cc @bnoordhuis