4.0: API usage issues deprecating `X509_cmp_timeframe()` and `X509_cmp_time()`

#29152 recently brought semantic improvements, but I am unhappy with deprecating

int X509_cmp_time(const ASN1_TIME *s, time_t *t);
int X509_cmp_current_time(const ASN1_TIME *s);
int X509_cmp_timeframe(const X509_VERIFY_PARAM *vpm, const ASN1_TIME *start, const ASN1_TIME *end);

BTW, these deprecations, if they stay, should be mentioned in CHANGES.md.

Maintaining libSecUtils, I recently realized that this provides hick-ups to OpenSSL users,
which I worked around in https://github.com/siemens/libsecutils/pull/70.

I wonder why the existing functions have not been kept (with the given improvements, of course).
In particular, it has been suggested to replace using X509_cmp_timeframe() by X509_check_certificate_times(), but this

• requires awkward changes to result checking and error reporting and
• does not work for checking the validity period of non-cert structures like CRLs,
  for which I came up with an ugly workaround like this:

int UTIL_cmp_timeframe(OPTIONAL const X509_VERIFY_PARAM *vpm,
                       OPTIONAL const ASN1_TIME *start, OPTIONAL const ASN1_TIME *end)
{
#if OPENSSL_VERSION_NUMBER < 0x40000000L
    return X509_cmp_timeframe(vpm, start, end);
#else
    X509 *dummy_cert = X509_new(); /* needed as a workaround for OpenSSL API restriction */
    int res = 1, error = X509_V_OK;

    if (dummy_cert != NULL) {
        (void)X509_set1_notBefore(dummy_cert, start);
        (void)X509_set1_notAfter(dummy_cert, end);
        res = X509_check_certificate_times(vpm, dummy_cert, &error);
        X509_free(dummy_cert);
    }
    return res == 1 ? 0 : error == X509_V_ERR_CERT_NOT_YET_VALID ? -1:
        error == X509_V_ERR_CERT_HAS_EXPIRED ? 1 : 0;
#endif
}

One option would be to retain at least X509_cmp_timeframe() (likely basing it and X509_check_certificate_times() on their improved common behavior).

Start by reading issue #29152 and reviewing the listed X509_cmp_time(), X509_cmp_current_time(), and X509_cmp_timeframe() APIs alongside X509_check_certificate_times(). Compare the compatibility and non-certificate use cases described here; completion requires a decided API direction and, if the deprecations remain, an entry in CHANGES.md.