Did you actually read the second diff you linked? They did not put anything back again. They removed even more junk. It is all deletions.

I'm getting tired of all the people who complain about the humour, tone or style in the commit messages. If you have serious concerns, why not read the diffs and comment on the actual changes? This is how real problems get noticed and corrected.

But some things were in fact removed and put back again, because it turns out some ports depended on it. Sometimes you just don't notice what a few thousand other applications depend on before you remove some code.

You're right. I'm wrong about number 2. Mea culpa.

Also look at the manpage for explicit_bzero: http://www.openbsd.org/cgi-bin/man.cgi?query=bzero&sektion=3

It already does what OpenSSL_cleanse is meant to do, so using it makes sense.

You are seeing this because they are working in public. Any of us would look like fools if you saw our intermediate work product.