@dalias your mention of constructors reminded me of this ticket regarding destructors. https://github.com/openssl/openssl/issues/23575
Unfortunately constructors are pretty much the safest way to do library init, especially in a threaded program. And you could do all kinds of mischief in a destructor too, running long after privilege checks were done.