@Christopher Allan Webber ah, okay. That makes a lot of sense.

WRT security, that's a very good point. I use different computers often enough that not having my package list under version control is something that's unsustainable, but you're totally right. (MELPA in particular didn't even do TLS for a long time, although that's thankfully not the case these days.) *sigh* I guess I should add "make ELPA have better security" to my endless TODO list :)

I've also never really regretted upgrading a package, even though I'm not even on MELPA Stable. How many packages do you use? (I'm sure it's more than me!) Or perhaps that's the wrong question - a better one might be, how many SLOC do you have in your .emacs that customize packages, and how complex are the customizations (e.g. just setq or something more complicated)?