Also includes significant cleanups scattered around.

This does not include any #ifdefs for /usr/include/openssl/cmac.h
It works on all my test systems but might fail on some really
old/conservative systems.  If so, we get to decide whether we
should add the #ifdefs or drop support.

This gives an error message from waf configure
rather than waf build