> According to https://github.com/travis-ci/travis-ci/issues/9069#issuecomment-395471575, setting "dist: xenial" instead (giving Ubuntu 16.04) provides a testing environment with a new enough OpenSSL for 3.7 to work.

No, this doesn't work either. The xenial environment is an experimental feature and doesn't work at all reliably. At the time of this writing setting "dist: xenial" actually puts you into Trusty.

Currently the viable ways of making it work on Travis are to either run a custom docker image (which requires you to opt out of their containerized builds and thus makes everything slower), or to build OpenSSL yourself (and making the latter work correctly is a far from straightforward process).