And one last thing: what about those last two deps? i.e. openssl and libcrypt?
Yes, we have plans to turn those into dlopen() deps too. Hopefully in v260.
And once we achieve that things are going to be fun, because systemd will start to have a smaller minimal dep footprint than certain other "lightweight" init systems. For example, that dependency hog s6 is currently at 3 shared library deps beyond libc. So wasteful! And it doesn't even do a fraction of what systemd does...