I am not in the PPMC specifically to avoid participating in this type of discussions, but I have to say this, just IMHO:
I fail to understand why the ASF is not considered neutral, deep inside I think the reason is simply because this year we got a bigger toy in our Christmas tree that they wanted. Hope I am wrong. We owe to our millions of users out there to maintain our own security channels and we cannot delegate them to a third party. Looking for an unrelated domain to handle our issues is like giving your children to your neighbors so they educate them "impartially". If there is no interest in bringing the code bases together I think there Is not much to gain on a shared security list on the long run. Pedro.
