Were the relevant changes sent to "upstream" spasm-ng, so that maintenance is easier in the long run ?

Done now.

I've also made some gratuitous upgrades to the web-based interface- using a fancier editor widget and currently working on "click on errors to jump to the relevant line".
http://media.taricorp.net/spasm-ng/spasm.html

Here's a screenshot of the new features.

Throwing out an idea, because I don't have time to try it at the moment: using the libtommath ( http://www.libtom.net/ , https://github.com/libtom/libtommath ) for multi-precision integer support, instead of GMP. There seem to be fewer files in libtommath than in GMP; libtommath's license is as free as can be (WTFPL); the Github repository shows semi-regular, recent activity.

The associated libtomcrypt has an implementation of MD5, but simply copying one of the reference, public domain implementations into spasm would be even simpler.

Are we using GMP for anything other than MD5? why not use a Javascript FFI call for that?

OpenSSL is used for MD5, GMP is used for signature generation. There's nothing very difficult about the functions required for signing, except computing the Legendre symbol- none of the bignum libraries I looked at support it (tommath does).

But yes, my expectation has been that some of this currently-missing functionality would be implemented with FFI calls in the browser.