Since it&#x27;s now clear that &quot;many eyes makes all bugs shallow&quot; is patently false, the MO for said agencies to compromise OSS projects is to play the long game of making numerous benign commits, becoming trusted, then committing subtly compromised code.<p>This would be much easier than compromising specific algorithms or KE protocols. Cheap, too. All it takes is plenty of patience.