Instead of a git submodule allow botan-src to checkout a tag

[randombit]

Discussion in #94

For released versions, we should download the tarball, and check it against an embedded SHA-256

[randombit]

openssl-sys seems to support a lot of features wrt version autodetection, etc here so may be a good one to study.

[randombit]

Becomes possible with #109/#137