However, to generalize my question
If I allow a user to download any dylib (e.g. OpenSSL) and load that will I need both these:
com.apple.security.cs.allow-dyld-environment-variables
com.apple.security.cs.disable-library-validation
Or just
com.apple.security.cs.disable-library-validation