[ggm]

I like couching this as "technical debt" into the future. Feels like something which has to be reviewed, the question being "when" not "if"

[hangonhn]

Ideally when you declare something as technical debt, you should work to stop accumulating it. If possible, use AES-256 instead of AES-128 but you don't have to drop everything to switch to 256 today or even next 6 months.