@pluralistic And on the other hand we have "Jia Tan" running a multi-year clandestine op pretending to be a real xz maintainer, carefully handcrafting the finest of backdoors only to get defeated by a Postgres nerd before he could launch it.

Typical government IT-spend. Straight to obsolescence.