ciphers

The deterministic key generator is essentially how most streaming ciphers designs work (well, aside from those derived from block ciphers), and generally offers weaker protections than block encryption.

On the other hand, the attack area for OpenSSL is the TLS implementation itself, and not the ciphers.

Also note that s2n links with OpenSSL (or LibreSSL, BoringSSL) for the ciphers and ASN.1 functionality.

Another point worth mentioning is that Erlang/OTP uses OpenSSL, but only for the cryptographic ciphers.

What about upgradeability -- does the protocol have the ability to roll in additional keys/exchange algos or ciphers as better ones become available?

The ciphers are pretty damned solid — the ASN.1 code… not so much.

Use Blowfish in cascading ciphers with other strong one's such as AES candidates.

But it's pretty easy to get lower grades by not having an up-to-date server which restricts broken ciphers like TLS 1.0 and SSL.

You probably also want to set kex, ciphers and MAC preferences in your client config for when you connect to servers with suboptimal settings.

Point 3 is highly debatable—people have always (since the invention of the cipher) had ways to secure their physical assets with ciphers, languages, etc.

Typically, cryptographic primitives (like block ciphers, hash functions, KDFs, etc) are written in C.

Are any governments using any of the estream ciphers internally?

The performance of stream ciphers is more competitive, you lose the requirement to define 8-10 "official modes" (most of which are insecure), and stream ciphers are virtually always what you want anyways: in 2015, block ciphers mostly exist in order to be transformed into stream ciphers via counter mode.

Ciphers that are the same can't be used in a row (meet in middle).