They were notified _six months ago_, in a disclosure process that included coordination with CERT, Microsoft, Mozilla, Apple, Google, and a zillion clients nobody has ever heard of. What about this specifically do you feel was “irresponsible”?
According to Werner Koch, they didn’t just contact GPG — they had an actual _dialogue_ with them, where Koch asked questions and they answered. Koch decided NBD.
The Ruhr team even offered to get on the phone with Koch, who decided not to.
Koch got the paper — which would have been available to him if he hadn’t shut down the Ruhr team — 2.5 weeks ago, by his own account.
