I think many eyes + code audits is a good mix. It seems like OpenSSL has many eyes but the code is so incredibly complex and "big" that audits are nearly impossible (or prohibitively expensive).

Perhaps we need to hit the reset button, and have a bit more oversight into "NewSSL" with continuous audits. There are enough big players in need of secure communication that money shouldn't be a problem.