True but there is also a difference in priority with different package maintainers which isn't always helpful. Why were old features removed from the upstream

True but there is also a difference in priority with different package maintainers which isn't always helpful. Why were old features removed from the upstream packages? Probably because upstream either wanted to ditch old/insecure protocols or the usage was too low to warrant the investment in keeping it alive. That is completely reasonable for them. Then look at something like SSLPing, it wants to support old protocols because that is part of the feature set for older servers which have no realistic need to update. It's something I find a bit troubling about the very vocal "security" crowd for whom only the latest and greatest ciphers/protocols/short-lived ssl certs/stronger DH key pairs are acceptable and everything else is garbage. Sadly, it seems that realistically, only paying/charging will help this because then it is reasonable for someone to spend 40 hours of their week keeping up with the changes/building their own libraries/etc. to keep their project running.