Yes, part of the issue here is that there hasn't been a ton of ownership on rustup, and even the Cargo team has not had as much time and effort as we'd like. We're currently working on growing both teams, which means better ownership, which means someone to make these calls.

> "I don't know much about it, so let's kill it" is a really bad precedent.

I would agree, but a "completely ignore security" flag is something to be cautious about.