Move BN_CTX_start() call so the error case can always call BN_CTX_end().