I think I figured out why all these issues are popping up all of a sudden.
A couple of months ago, Xenial's libmysqlclient 5.7.28-0ubuntu0.16.04.2 made the following change:
``` * debian/rules: removed -DWITH_SSL=bundled, option no longer works. * debian/control: add libssl-dev to Build-Depends. ```
Before that, the `WITH_SSL=bundled` option was the default, and "bundled" didn't actually use OpenSSL but yaSSL (see https://mysqlserverteam.com/mysql-is-openssl-only-now/)!
So in the past, the db_mysql module would use YaSSL and the tls module would use OpenSSL and everyone was happy. But now suddenly both modules use OpenSSL (1.0.2, in Xenial) and there's a conflict with how both of them handle locking callbacks.