Technically, every distro that ships KDE or any other Qt Quick application that uses SSL is, though one would hope there's an exception for those. Beyond that, who knows? Someone would have to do an audit.