I call is sustainable based on the evidence of tons of projects sustaining themselves. Many for decades.

There are flaws in OpenSSL and they were corrected. Sometimes projects like gpg die off. That stinks, but there are other options.