Biggest discovery when researching this was due to the ALPN requirement in Chrome [1], openssl 1.02 being required for ALPN, and the vagaries of Linux distro release schedules, Ubuntu 16.04 is the only LTS distro than can serve HTTP/2 to Chrome users.
When they're eventually announced, RHEL/CentOS 8 (Fedora already has the necessary openssl) and Debian 9 will also work. But right now Ubuntu is your only bet unless you want to build and maintain your own openssl. Which you don't.
Interesting. What's the maintenance policy for jessie-backports? If it's best-effort it might be better to avoid suggesting people use it for a package as frequently updated as openssl.
Given what I'm seeing on the Nginx build currently in backports, I might rely on backports for dependencies, but I'd seriously consider building your own Nginx from source and/or pay attention yourself to security warnings.
Biggest discovery when researching this was due to the ALPN requirement in Chrome [1], openssl 1.02 being required for ALPN, and the vagaries of Linux distro release schedules, Ubuntu 16.04 is the only LTS distro than can serve HTTP/2 to Chrome users.
When they're eventually announced, RHEL/CentOS 8 (Fedora already has the necessary openssl) and Debian 9 will also work. But right now Ubuntu is your only bet unless you want to build and maintain your own openssl. Which you don't.
[1] https://bugs.chromium.org/p/chromium/issues/detail?id=527066