Probably because very little innovation happens to any long-standing protocol <i>until</i> it becomes a primary business concern.<p>Almost every business relies on OpenSSL or some equivalent, but how many actually learn enough about SSL to contribute back to the codebase?  Not many, because despite the need there&#x27;s little acclaim or funding to be had pursuing things that won&#x27;t make direct revenues, regardless of their importance.<p>Protocols like this generally don&#x27;t get updated until it becomes a matter of necessity -- either by public awareness (we&#x27;re far from that point) or someone designing the &quot;next big thing&quot; needs an un-implemented feature and contributes.