I've been following this bug because it came up as an issue for a security upgrade to libgnutls-openssl27 in buster. I'm still seeing 3.6.7-3 as the upgrade target.
Will an openssl27 variant be coming? Or perhaps this problem never applied to -openssl27 and apt-listbugs just got over-eager? I came here for ..ssl27; the original report is for ..ssl28; the package the bug is filed against is apparently ..ssl30. The versioning is a bit mysterious to me :) Ross