If something is purely optional, i.e., the product can be used productively without a given feature, then that feature may be included in a product as an option, even if that option requires additional restrictions to be imposed over and above what the Apache License requires. Ideally, this exemption is only used in cases where significantly less than half of the installations require this feature.
most people use httpd without cryptographic security. Many people, however, do make use of SSL/TLS features, and httpd provides, as an option, a module which provides such functions. Such a feature can only be distributed in accordance with export regulations