anchor.diff:  
   class procedure TRSA.LoadOpenSSL;
   begin
  -  if not IdSSLOpenSSLHeaders.Load then
  -    raise Exception.Create('[RSA] Unable to load OpenSSL DLLs');
  -
  -  if @EVP_DigestVerifyInit = nil then
  -    raise Exception.Create('[RSA] Please, use OpenSSL 1.0.0. or newer!');
  -end;
  -
  -end.
  +  if FOpenSSLHandle = 0 then
  +  begin
  +    if not IdSSLOpenSSLHeaders.Load then
  +      raise Exception.Create('[RSA] Unable to load OpenSSL DLLs');
  +
  +    if @EVP_DigestVerifyInit = nil then
  +      raise Exception.Create('[RSA] Please, use OpenSSL 1.0.0. or newer!');
  +
  +    FOpenSSLHandle := LoadLibrary('libeay32.dll');
  +    if FOpenSSLHandle = 0 then
  +      raise Exception.Create('[RSA] Unable to load libeay32.dll!');
  +
  +    _PEM_read_bio_RSA_PUBKEY := GetProcAddress(FOpenSSLHandle, 'PEM_read_bio_RSA_PUBKEY');
  +    if @_PEM_read_bio_RSA_PUBKEY = nil then
  +      raise Exception.Create('[RSA] Unable to get proc address for ''PEM_read_bio_RSA_PUBKEY''');
  +
  +    _EVP_MD_CTX_create := GetProcAddress(FOpenSSLHandle, 'EVP_MD_CTX_create');
  +    if @_EVP_MD_CTX_create = nil then
  +      raise Exception.Create('[RSA] Unable to get proc address for ''EVP_MD_CTX_create''');
  +
  +    _EVP_MD_CTX_destroy := GetProcAddress(FOpenSSLHandle, 'EVP_MD_CTX_destroy');
  +    if @_EVP_MD_CTX_create = nil then
  +      raise Exception.Create('[RSA] Unable to get proc address for ''EVP_MD_CTX_destroy''');
  +  end;
  +end;
  +
  +initialization
  +    TRSA.FOpenSSLHandle := 0;
  +    TRSA._PEM_read_bio_RSA_PUBKEY := nil;
  +    TRSA._EVP_MD_CTX_create := nil;
  +    TRSA._EVP_MD_CTX_destroy := nil;
  +
  +end.
  
positive.code:   PubKeyBIO := BIO_new(BIO_s_mem);
    try
      BIO_write(PubKeyBIO, @AKey[0], Length(AKey));
      rsa := PEM_read_bio_RSAPublicKey(PubKeyBIO, nil, nil, nil);
      if rsa = nil then
        raise Exception.Create('[RSA] Unable to load public key: '+ERR_GetErrorMessage_OpenSSL);
    finally
      BIO_free(PubKeyBIO);
    end;
  
    // Extract Public key from RSA object
    PubKey := EVP_PKEY_new();
    if EVP_PKEY_set1_RSA(PubKey,rsa) <> 1 then
      raise Exception.Create('[RSA] Unable to extract public key: '+ERR_GetErrorMessage_OpenSSL);
  
    locBio := BIO_new( BIO_f_md );
    locSHA := nil;
    try
      // Create context. Use this strage hack since Indy library has no EVP_MD_CTX_create
      BIO_get_md_ctx( locBio, @locCtx );
  
      case AAlg of
        RS256: locSHA := EVP_sha256();
        RS384: locSHA := EVP_sha384();
        RS512: locSHA := EVP_sha512();
      end;
  
      if EVP_DigestVerifyInit( locCtx, NIL, locSHA, NIL, PubKey ) <> 1 then
        raise Exception.Create('[RSA] Unable to init context: '+ERR_GetErrorMessage_OpenSSL);
      if EVP_DigestVerifyUpdate( locCtx, @AInput[0], Length(AInput) ) <> 1 then
        raise Exception.Create('[RSA] Unable to update context with payload: '+ERR_GetErrorMessage_OpenSSL);
      result := ( EVP_DigestVerifyFinal( locCtx, PAnsiChar(@ASignature[0]), length(ASignature) ) = 1 );
    finally
      BIO_free( locBio );
    end;
  end;
  
  
negative.code:   IdSSLOpenSSLHeaders,
    JOSE.Encoding.Base64;
  
  const
    PKCS1_SIGNATURE_PUBKEY:RawByteString = '-----BEGIN RSA PUBLIC KEY-----';
  
  type
    TRSAAlgorithm = (RS256, RS384, RS512);
  