Right now, openssl is only used by libcurl, but the libcurl BUILD.gn is where cert.pem is bundled up for the app. The cert.pem bundling arose during the development of gen_curl_config.py and should really be moved over to the openssl BUILD.gn.
Since nothing has broken yet (nothing depends on openssl but not libcurl), and it should be relatively minor to fix, we're just going to file it away here for later.