I don't agree that this is so very urgent.  As far as I can tell, it only
affects distributors of darcs binaries who link with builds of libcurl that link
with openssl on systems where openssl is not part of the operating system. 
Which I guess means that perhaps it only affects Windows.  Even then, it's quite
possible to simply avoid the use of openssl.

I did recently add a configure option to link directly with openssl (for its
SHA1 code), but tests suggest that this has no performance benefit over the
gnulib code and it's not a big deal.  We could more easily remove that configure
option than relicense darcs.

David