Especially with crypto, one small implementation error could ruin any security value. It's completely reasonable that they don't want their trademark used with code they aren't responsible for.

Yeah. "You can do whatever you want with our GPL'd code, so long as you follow the license, and we don't have any patents, just don't use our name/branding on stuff we don't control" is a reasonable way to ensure the reputation of your name. It's the same thing Firefox does with Linux distros who want to add their own patches.

> It's the same thing Firefox does with Linux distros who want to add their own patches.

"did", I think. I don't know which distros still run into this, but Debian now ships Firefox (RIP Iceweasel).

Or, conversely, modifications could add to the security value.