I think code should be using groupmember(9) instead of rolling our own.

Reflect reviewer comments.

Looks reasonable.

I only looked into lib/{expat.h,internal.h,siphash.h,xmlparse.c} and these looks fine.

For libmd, please also remove the _Transform functions from the header (.h) files.

Could you please remove these _version symbols? They are not supposed to be used by consumers and should be made static or commented out in the source files.

The most important change was to add support of TLS, which is #ifdef'ed out and the rest of change is not quite worth the effort IMHO.

The idea is interesting (I have never thought about a MAC policy to accomplish this goal) and I like its simplicity, please see comment inline for some minor nits.

Can we merge this?