Many servers support TLS only, so implementing the client side of TLS was a matter of compatibility, not security. If external dependencies are allowed then why not just use libcurl?