Problem 1: The CRA regulates open source projects receiving donations

Problem 2: The CRA regulates open source projects with corporate developers

Problem 3: The CRA breaks coordinated vulnerability disclosure