This can use SUBDIR.${MK_BEARSSL}+=libbearssl libve style, no?

Options files typically start with a one-sentence description and I think that improves the flow of the generated man page. (They also typically start with Set to build or Set to not build, which I don't think improves readability.)

E.g., just start with "Build the BearSSL library."

Is there specific markup for URLs?

This out-of-tree bearssl src should go.

The intent was that it would eventually end up in contrib/ but didn't think that should be a gating factor?

If we're ready to start adding the build goop we should just put it in contrib

We should just import it, even if it isn't in the default built, I agree. Having out-of-tree support for it I think slows the adoption of it for the base.

This should probably be

LIBSECUREBOOT?= ${LIBSECUREBOOTDIR}/libsecureboot.a

Since the verification library is now called "libsecureboot" perhaps we should rename this to "LOADER_SECUREBOOT" or something similar.

Found it, .Lk

Thanks

That depends a bit on your plans.
LOADER_VERIEXEC is a reasonable description of what my patches currently do
LOADER_SECUREBOOT could also be valid but you might want a separate knob to select different behavior - with LUA in loader there is not a lot of headroom.

Where?

Is the syntax

.Lk http://www.BearSSL.org/

?

from mdoc(7):

Lk
  Format a hyperlink.  Its syntax is as follows:

        .Lk uri [name]

  Examples:
        .Lk http://bsd.lv "The BSD.lv Project"
        .Lk http://bsd.lv

  See also Mt.