In the last GNU related post about Emacs, a security person suggested changing defaults related to TLS to address many of the known dangers with the current PKI

In the last GNU related post about Emacs, a security person suggested changing defaults related to TLS to address many of the known dangers with the current PKI situation. There, the lead developer apparently didn't want to change the defaults because that would somehow be top-down aggression against user choice in the style of the TSA at the airport. Here, you are saying that GNUK won't add FIDO U2F because the lead dev is critical of the whole PKI system. Thus, the GNUK user doesn't get defaults which allow them to easily bootstrap into the web services that are used by a large portion of the population. I mean, that's fine and justifiable as individual projects go. But one could just as easily imagine the approach of these two projects switched so that Emacs reflexively reacted by choosing the most secure TLS settings for defaults, and GNUK being liberal with which protocols they add. So what's the point of the Gnu umbrella if users and potential devs essentially roll a roulette wheel to guess how each developerbase prioritizes something as critical as security?