What concerns do we have about the volunteers who adopt Cygwin packages? If a volunteer were to have bad intentions, do we think we would notice before any actual problems were introduced? Imagine malware from a North Korean team, for example.
Michael