untrusted comment: signature from openbsd 5.9 base secret key
RWQJVNompF3pwYYht8Up5vKYL6HwbPCj/eSG7J/p94oFAmSiSOJ3MYpZFVIUCR4Ro5YumxOdhcIQgZb5KMjHNuczsKkCSYfWjAk=

OpenBSD 5.9 errata 33, Jan 5, 2017:

Avoid possible side-channel leak of ECDSA private keys when signing.

Apply by doing:
   signify -Vep /etc/signify/openbsd-59-base.pub -x 033_libcrypto.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install libcrypto:
       cd /usr/src/lib/libcrypto
       make obj
       make depend
       make
       make install

Index: lib/libssl/src/crypto/ecdsa/ecs_ossl.c
===================================================================
RCS file: /cvs/src/lib/libssl/src/crypto/ecdsa/Attic/ecs_ossl.c,v
retrieving revision 1.6
retrieving revision 1.6.2.1
diff -u -p -r1.6 -r1.6.2.1
--- lib/libssl/src/crypto/ecdsa/ecs_ossl.c      8 Feb 2015 13:35:07 -0000       1.6
+++ lib/libssl/src/crypto/ecdsa/ecs_ossl.c      5 Jan 2017 13:27:17 -0000       1.6.2.1
@@ -141,6 +141,8 @@ ecdsa_sign_setup(EC_KEY *eckey, BN_CTX *
               if (BN_num_bits(k) <= BN_num_bits(order))
                       if (!BN_add(k, k, order))
                               goto err;
+
+               BN_set_flags(k, BN_FLG_CONSTTIME);

               /* compute r the x-coordinate of generator * k */
               if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) {