The FSMs that drive the encryption logic are not performance critical, but they are very large. Build BearSSL using -Os on them, leaving -O2 everywhere else (i.e. encryption) for speed. Saves 1-2KB of flash for SSL applications.