> Though, I think that the time between PSM1 and PSM2 will be significant.
Indeed you're probably right there. Fortunately security-focused distributions and individuals would be able to change the defaults in the interim.
I think the most important point here is that with those different patch sets, the more security-conscious users/companies get to have the properly hardened version immediately into use, rather than running the "only report" versions for what might be years, as you say.
Granted, I'm looking at this from a perspective where our company compiles our own kernel for use in embedded devices, so we can have whatever patch sets supported we want. But I think that's much better than everyone having to use the "report only" patches for years, or even worse, the features never getting into the kernel in the first place.
Might take years but atleast the airplanes keep flying instead of crashing their computers and consequently themselves.