- Make it a separate opensslrsa_check_exponent_bits() function to clean up the code a bit - Always use provider API first if using openssl 3.0, and fallback to EVP API for older openssl or if built with engine support - Use RSA_get0_key() (with shim for openssl 1.0) to avoid memory allocations