The updated openssl package now conflicts with "libcurl (<< 7.61.0-1)", so no one will get openssl 1.1.1 without also getting an updated libcurl 7.61.1-1 linking against it. From the other direction the new libcurl depends on "openssl (>= 1.1.1)", so no one will get libcurl 7.61.1-1 without also getting the updated openssl 1.1.1 which it uses.