apr-util should be ported to use NSS library for cryptography. See the tracking bug for details and links on how it could be done.
apr-util has MD5, SHA1, and MD4 implementations, which are easy enough to switch out to an external library, except that IIRC NSS does not implement MD4. Are there plans to change that? Otherwise, apr-util exposes the interface to the OpenLDAP support via the apr-util API, dependent on the OpenSSL API/ABI, and changing that is probably a big ABI-breaking PITA.
apr-util has equal support for NSS & OpenSSL