"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
So what if someone tried to crowdfund a new implementation (or a thorough rewrite of OpenSSL, if that makes more sense).  Could they raise something on the order of $1M?  It seems like it would cost that much for, I'm guessing, three absolutely top developers for two years.  Unlike a lot of crowdfunded projects, this one would not launch a business -- there's no additional revenue opportunity for the developers once it's completed -- so the amount would have to compensate them not just for their time but also for their opportunity cost.<p>On the other hand, given the importance of TLS to the Internet, $1M seems less than trivial -- literally pocket change, if the cost were well distributed among the millions of websites using SSL.<p>What do you think?  Could it be done?