This is an argument for vanilla distributions. The most sensible place for expert code review (a limited resource) is the upstream project. By comparison, dis

This is an argument for vanilla distributions. The most sensible place for expert code review (a limited resource) is the upstream project. By comparison, distro modifications receive relatively little review. If the Debian patch had been mailed to openssl-dev, I doubt it would have quietly gotten "LGTM" replies and been picked up by a maintainer.