CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or
more recipient certificates and, for an EC recipient, generate an ephemeral
key in the recipient's group. If the certificate declares a group order of 1,
random scalar generation can only produce zero. The key generation routine
then retries without limit while waiting for a nonzero private scalar, so the
call never returns.