Not a perfect solution but sufficient for stretch is the patch below to use OpenSSL 1.0.2
The "| libssl-dev (<< 1.1.0~)" is added for backports. --- debian/control.old 2016-11-27 19:00:22.000000000 +0000 +++ debian/control 2016-11-27 19:00:30.000000000 +0000 @@ -20,7 +20,7 @@ libxinerama-dev, dctrl-tools, libarchive-dev, - libssl-dev, + libssl1.0-dev | libssl-dev (<< 1.1.0~), zlib1g-dev, libunwind8-dev [amd64 armel armhf i386 mips powerpc ppc64], dh-autoreconf (>= 6~), cu Adrian -- "Is there not promise of rain?" Ling Tan asked suddenly out of the darkness. There had been need of rain for many days. "Only a promise," Lao Er said. Pearl S. Buck - Dragon Seed