Ideally istio/proxy should be able to build envoy/envoy AND envoy/envoy-openssl, maybe just passing a build flag.

Then we don't need a fork of istio/proxy for this purpose.

We would still need a fork of istio/proxy but mostly for vendoring stuff, and other specific downstream changes, just like the istio fork we have for 3.0