I call is sustainable based on the evidence of tons of projects sustaining themselves. Many for decades.
There are flaws in OpenSSL and they were corrected. Sometimes projects like gpg die off. That stinks, but there are other options.
There are flaws in OpenSSL and they were corrected. Sometimes projects like gpg die off. That stinks, but there are other options.
There area huge number of libraries are are becoming unmaintained due to lack of resources, which will likely cause problems down the line.
I'm not sure I'd call it a crisis, but it's definitely a problem.