Although your question could call for opinion-based answers,
I will consider it is formulated as "what would be the pros and cons of any solution over the others?" (and your draft of solutions shows open-mindness and smartness).

I would say: KISS, so go for shell + openssl CLI. You'll gain portability (ability to run it over other Linux or POSIX servers that don't have Node (even Macs or Windows with WSL!), for example a DB server) and avoid maintenance headache, with one tool to rule them all.