FWIW, Jamie asked me to audit an earlier version of this code. I haven't looked at the version he released, but the version I saw looked secure to me (subject to the assumption that OpenSSL bugs aren't exploitable, at least).
.. and I owe much thanks to you for your feedback (and almost all of it was incorporated); I just hadn't asked you for permission to bring your name into the picture, so I didn't! ;-)
