Hi Reinhard,
Presumably the many other affected packages have had similar difficulty in developing a comprehensive solution? I also wasn't aware of a time constraint. Not that it would have helped me much, as I was moving house, but it would have been good to know that there was a risk of not making Debian 10.
I'm sorry, I should have communicated that point earlier. I've been bitten by this with other packages as well.
In short: The team is minimizing changes as much as possible, and getting updates in becomes more and more a similar big deal as updating something in stable.
I could create a special branch with a cut-down version of the solution, e.g. forcing the SecurityLevel to -1 (compatibility and warn) for the time being, in order to get the fix out in time for Debian 10, and then put the full version into backports?
That would be amazing, if the patch is easy to review, I'd be happy to upload it as a distro patch based on the current package and try to get this approved by the release team. It might even be accepted as a stable update, depending on how invasive it is.