How is the frequency of upgrade relevant to the security of the system? If given a new version, people tend to upgrade and I take control of your software update mechanism, how is the security risk any less? You'd presumably argue that we should have higher security standards for a software update mechanism than a web application. If that's the case, would you agree that any web application that's as secure as a software update mechanism, should be allowed to distribute JS crypto?

Edit: I have no specific problem running ssh as a Java applet if I trusted the site and connection. How do you determine when you're comfortable upgrading ssh or any other security program through your package manager?