The 1990s cryptography wars taught us that: strong crypto (e.g., PGP) was once treated as a munition under export controls, yet secure practice ultimately came from open algorithms, open reference implementations, responsible disclosure and broad red teaming. Today even post‑quantum cryptography standards come from open processes.