Just a small update to people following this issue: The qt5 already updated to openssl 1.1, so the only remaining blocker is curl. In https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858398 there is some discussion about the right way to update curl, but I hope some agreement will be reached, soon.
As soon as libcurl with openssl 1.1 is available, I'll upload an updated package of zurl. Jan
