The "good" people at Emerson for some reason couldn't think for themselves when I responded to them on behalf of #curl and instead continue and send the same questions to the #libssh2 project with the same "demands".
"This is a gentle reminder regarding our earlier request for your input on the cybersecurity risk assessment of the software component βlibssh2β version 1.11.0, as part of our compliance efforts with the EU Cyber Resilience Act (CRA)."
2/ And to quote one bit from @corbet's[1] great #OSSNA25 talk:
""[β¦] there will be no core development conferences around #Linux and other things in the United States in the foreseeable future. [β¦] this is a real problem [β¦]""
Yes, this is not a formal announcement[2] β but it bears some weight, as Jonathan is well connected and among others sits in the Linux Foundation's Technical Advisory Board (TAB).
[1] https://www.youtube.com/watch?v=hNLBGiwfBSI&t=949s (for context starts a bit earlier; the quoted bit comes about a minute later)
[2] and kinda obvious for some of you