The OpenBSD fork is worth looking (I had a version of FreeBSD with the OpenBSD fork of cron in the svn age, but never got a chance to conclude the work and merge it) too. They have also merged atrun into cron to give it better time precision and reduce spams for logs.

I think these OPENSSL_VERSION_NUMBER >= 0x30000000L code will actually work with OpenSSL 1.1?

Some minor nits

Oh that's good point. I think you can avoid hardcoding the value and just grep over two files instead (see suggested edit).

LGTM (please remove the $FreeBSD$ before pushing)

LGTM, thanks!

Could you please move this chunk to the __BSD_VISIBLE block below near setprogname instead?

Address reviewer comments.

Thanks for the detailed review! Could you please take another look at the updated changeset?

LGTM

I think if we have only two possible choices, a if .. else if would be easier to follow.

Approved (doc).

LGTM, thanks!

LGTM

This adds approximately 600kB to the rescue binary (about 3.8%) on amd64 but I think it's a reasonable price to pay.