FYI; http://trends.newsforge.com/article.pl?sid=06/01/23/0429219 "OpenSSL receives FIPS certification"
which means that Ben's and my efforts, including axing all md5 and sha code from APR (well not literally; rather providing two alternatives - one the existing code, and second stubbing into openssl - when available & apr is built --enable-fips) and plugging into the 'final approved version' should be proceeding shortly, and we welcome all helpers. Bill
