> For example, the working group for vulnerability disclosure includes a lot of corporate players, and from what I can tell, not a single security researcher. Only one side of the disclosure process is represented in that working group

More importantly, the vulnerability disclosure group does not have a single contributor from the largest consumers of vulnerability disclosures: Linux distribution security teams.

And while I think they can go far improving the current situation, 'creating an API' isn't really the main pain point we are faced with when a legacy entity deals with handing out CVEs. Thus I'm unsure if a corporate-only working group is capable of getting a complete picture of problems regarding F/OSS vulnerability disclosure.