"Someone looked straight at it in 2015 and wrote down, in plain English, exactly why xz was dangerous."