> How did this manage to survive first amendment challenges?

This goes back to what Phil Zimmerman said about ITAR and such almost 20 years ago when they threw it at him for PGP:

"The Government has made it illegal in many cases to export good cryptographic technology, and that may include PGP. This is determined by volatile State Department policies, not fixed laws."

This has nothing to do with law and everything to do with those same volatile policies a generation later.