px5g still requires libmbedtls (in LEDE) or libpolarssl (in Openwrt).
In LEDE it is also possible to replace px5g with openssl-util and
achieve "openssl-only" build without libmbedtls, as uhttpd can also
generate keys with openssl commandline tools if px5g is not present.