Hi Ken, thanks for the reply.

> As Henri said, it's that it's a set of external dependencies (not just one; GnuTLS has its own dependencies) and that they are security-related.  To the greatest extent practical, security-related libraries should come from one's distro or OS vendor.

Sure, I can buy that.  I'll note that OpenSSL is also available for
the Mac, and already loaded by wininet and winhttp.  It could be
appropriate to move from GnuTLS to OpenSSL for schannel, so we'd only
have a single implementation for both Linux and Mac in schannel.